CVE-2026-63197

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQSTORAGETYPE=local can return user-uploaded SVG or HTML content from the /files/fileId retrieval endpoint for direct browser rendering. An attacker with file-upload capability can...

CVE-2026-63197: traPtitech traQ: traQ is a messenger application built for Digital Creators Club traP

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQSTORAGETYPE=local can return user-uploaded SVG or HTML content from the /files/fileId retrieval endpoint for direct browser rendering. An attacker with file-upload capability can...

CVE-2026-44977

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...

EUVD-2026-102918

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...

CVE-2026-44977

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...

PT-2026-115655

Name of the Vulnerable Software and Affected Versions countly-server versions prior to 24.05.50 countly-server versions prior to 25.03.44 Description A flaw in the star-rating plugin allows a non-global application administrator to upload active content via the uploadFeedbackFile function in the...

CVE-2026-55876

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...

CVE-2026-55876 Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...

CVE-2026-55876

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...

CVE-2026-55876 Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...

CVE-2026-55876

The Helium student planner (prior to version 2.2.60 ) is vulnerable to Stored XSS via the POST /planner/attachments/ endpoint. The root cause is that conf/configs/common.py fails to include SVG and HTML formats in the BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES lists, which th...

EUVD-2026-102221

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...

CVE-2026-55876: Improper Neutralization of Input During Web Page Generation

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...

CVE-2026-85573

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

EUVD-2026-89631

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

CVE-2026-85573: Improper Neutralization of Input During Web Page Generation

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

PT-2026-103030

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

CVE-2026-82387

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back wit...

CVE-2026-82387 Apache Roller: Stored cross-site scripting via uploaded media content type

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back wit...

CVE-2026-82387 Apache Roller: Stored cross-site scripting via uploaded media content type

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back wit...