EUVD-2023-53408

Malicious code in bioql PyPI...

EUVD-2022-33450

Malicious code in bioql PyPI...

EUVD-2022-4561

Malicious code in bioql PyPI...

EUVD-2023-54642

Malicious code in bioql PyPI...

EUVD-2023-50823

Malicious code in bioql PyPI...

CVE-2025-10755

A vulnerability was detected in Selleo Mentingo 2025.08.27. The impacted element is an unknown function of the component Content-Type Handler. The manipulation of the argument userAvatar results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be...

CVE-2025-10755 Selleo Mentingo Content-Type unrestricted upload

A vulnerability was detected in Selleo Mentingo 2025.08.27. The impacted element is an unknown function of the component Content-Type Handler. The manipulation of the argument userAvatar results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be...

CVE-2025-10755 Selleo Mentingo Content-Type unrestricted upload

A vulnerability was detected in Selleo Mentingo 2025.08.27. The impacted element is an unknown function of the component Content-Type Handler. The manipulation of the argument userAvatar results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be...

CVE-2025-10755

CVE-2025-10755 affects Selleo Mentingo 2025.08.27, with the vulnerable component in the Content-Type Handler. The issue arises from manipulation of the argument userAvatar , leading to unrestricted file uploads. The attack is described as remote and publicly exploitable; multiple sources cite a p...

CVE-2025-10741 Selleo Mentingo Profile Picture unrestricted upload

A security vulnerability has been detected in Selleo Mentingo up to 2025.08.27. The affected element is an unknown function of the component Profile Picture Handler. The manipulation of the argument userAvatar leads to unrestricted upload. The attack is possible to be carried out remotely. The...

CVE-2025-10741

CVE-2025-10741 affects Selleo Mentingo’s Profile Picture Handler. The root cause is manipulation of the userAvatar argument, enabling unrestricted file uploads in versions up to 2025.08.27 (before 2025.08.28). Exploitation is possible remotely and the exploit has been publicly disclosed, with PoC...

CVE-2025-56761

Memos 0.22 is vulnerable to Stored Cross site scripting XSS vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XS...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the ResetUserAvatar function in the API component when processing the filename argument. An attacker can overwrite or delete arbitrary files on the server by supplying crafted path values. Details A Directory...

CVE-2025-48480

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an authorized user with the administrator role or with the privilege User::PERMEDITUSERS can create a user, specifying the path to the user's avatar ../.htaccess during creation, and then delete the user's...

CVE-2025-48480 FreeScout Has Business Logic Errors

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an authorized user with the administrator role or with the privilege User::PERMEDITUSERS can create a user, specifying the path to the user's avatar ../.htaccess during creation, and then delete the user's...

CVE-2025-48480

CVE-2025-48480 affects FreeScout prior to version 1.8.180. An authorized user with the administrator role or with the privilege User::PERM_EDIT_USERS can create a user and specify the avatar path as ../.htaccess, then delete the avatar, causing deletion of the .htaccess file in the folder /storag...

CVE-2024-50649

The user avatar upload function in pythonbook V1.0 has an arbitrary file upload vulnerability...

CVE-2023-46621

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin = 1.4.11 versions...

CVE-2023-49444

An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...

CVE-2022-29020

ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar...