CVE-2025-60452

A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download management module, specifically in the app\system\download\admin\downloadadmin.class.php component. The vulnerability allows attackers to upload malicious SVG...

CVE-2025-60453

MetInfo CMS version 8.0 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability within the column management module , specifically affecting the app ew_system ew_column ew_admin ew_index.class.php (also referenced as app ew_system ew_column ew_admin ew_index.class.php) component. The ...

CVE-2025-60450

A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to...

PT-2025-40521

Name of the Vulnerable Software and Affected Versions MetInfo CMS version 8.0 Description A stored Cross-Site Scripting XSS issue exists in the download management module of the software. The vulnerability is located in the appsystemdownloadadmindownload admin.class.php component. Attackers can...

CVE-2025-60453

A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, specifically in the app\system\column\admin\index.class.php component. The vulnerability allows attackers to upload malicious SVG files...

Qt security vulnerabilities

Qt is a cross-platform application development framework from the Qt open source. A security vulnerability exists in Qt that stems from possible recursive rendering when rendering Svg files containing pattern elements, which could lead to a stack overflow denial of service...

GHSA-2C6J-VW6R-MFCH Fiora chat group avatar is vulnerable to XSS via SVG files

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

CVE-2025-56514

Cross Site Scripting XSS vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other users...

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

Fiora cross-site scripting vulnerability

Fiora - is a chat application by yinxin630 individual developer. A cross-site scripting vulnerability exists in Fiora version 1.0.0, which originates from the execution of arbitrary JavaScript while rendering a malicious SVG file, and could lead to a cross-site scripting attack...

Fiora security vulnerabilities

Fiora - is a chat application by yinxin630 individual developer. A security vulnerability exists in Fiora version 1.0.0, which stems from the user avatar upload feature not validating the content of SVG files, which could lead to the execution of arbitrary JavaScript code...

PT-2025-40256

Name of the Vulnerable Software and Affected Versions Fiora chat application versions 1.0.0 through 1.0.0 Description The Fiora chat application has a file upload issue related to the user avatar upload functionality. The application does not properly validate SVG file content. This allows...

CVE-2025-56514

A CVE entry for Fiora chat application 1.0.0 (CVE-2025-56514) documents a Cross Site Scripting (XSS) vulnerability arising when malicious SVG files are rendered by other users. Concrete details from connected sources show the vulnerability affects Fiora 1.0.0 and involves uploading or rendering a...

CVE-2025-8623 WeedMaps Menu for WordPress <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via weedmaps_menu Shortcode

The WeedMaps Menu for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's weedmapsmenu shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-40003

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-54476 Description Improper handling of input can result in a cross-site scripting XSS vector within the checkAttribute method of the input filter framework class. Recommendations At the moment, there is no information...

Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security

Microsoft is calling attention to a new phishing campaign primarily aimed at U.S.-based organizations that has likely utilized code generated using large language models LLMs to obfuscate payloads and evade security defenses. "Appearing to be aided by a large language model LLM, the activity...

Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security

Microsoft is calling attention to a new phishing campaign primarily aimed at U.S.-based organizations that has likely utilized code generated using large language models LLMs to obfuscate payloads and evade security defenses. "Appearing to be aided by a large language model LLM, the activity...

SVG Security Analysis Toolkit

SVG Security Analysis Toolkit contains specialized Python tools for analyzing potentially malicious SVG files and detecting security mechanisms...

cifs Component Denial-of-Service

The vulnerability of the cifs component in the Linux operating system’s kernel is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to trigger a Denial-of-Service attack...