6755 matches found
SUSE CVE-2024-57004
Cross-Site Scripting XSS vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session...
CVE-2024-6309
The Attachment File Icons AF Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.3. This is due to missing nonce validation in the 'afioverview' function and missing file type validation in the 'uploadicons' function...
DEBIAN-CVE-2024-57004
Cross-Site Scripting XSS vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session...
UBUNTU-CVE-2024-57004
Cross-Site Scripting XSS vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session...
PT-2025-3376
Name of the Vulnerable Software and Affected Versions Roundcube Webmail version 1.6.9 Description The issue allows remote authenticated users to upload a malicious file as an email attachment. This leads to the triggering of a Cross-Site Scripting XSS attack when the SENT session is visited...
Roundcube Webmail 安全漏洞
Roundcube Webmail is a browser-based open source IMAP client from Roundcube Open Source that supports address book management, message searching, spell checking, and more. A security vulnerability exists in Roundcube Webmail version 1.6.9, which stems from the presence of a cross-site scripting X...
Mattermost Mobile Apps Denial of Service Vulnerability (CNVD-2025-11094)
Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A denial of service vulnerability exists in Mattermost Mobile Apps that stems from the application failing to properly handle specially crafted attachment names. An attacker could use this vulnerability to cause the...
CVE-2024-13361
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicgsaveimagemedia function in all versions up to, and including, 1.8.96. This makes it possible for authenticated attackers, with Subscriber-level access and above,...
CVE-2025-0625
A vulnerability, which was classified as problematic, was found in CampCodes School Management Software 1.0. This affects an unknown part of the component Attachment Handler. The manipulation leads to improper control of resource identifiers. It is possible to initiate the attack remotely. The...
CVE-2025-0625
A vulnerability, which was classified as problematic, was found in CampCodes School Management Software 1.0. This affects an unknown part of the component Attachment Handler. The manipulation leads to improper control of resource identifiers. It is possible to initiate the attack remotely. The...
CVE-2025-0625 CampCodes School Management Software Attachment resource injection
A vulnerability, which was classified as problematic, was found in CampCodes School Management Software 1.0. This affects an unknown part of the component Attachment Handler. The manipulation leads to improper control of resource identifiers. It is possible to initiate the attack remotely. The...
PT-2025-3987
The CampCodes School Management Software version 1.0 has a security issue in its Attachment Handler component, allowing for improper control of resource identifiers. This can be exploited remotely with a relatively high complexity of attack and is considered difficult to exploit. An exploit has...
GHSA-W59H-3X3Q-3P6J Authenticated Stored XSS in YesWiki
Authenticated Stored XSS in YesWiki wiki-href'upload', $this-wiki-GetPageTag, "file=$this-file" . '" class="btn btn-primary" ' . t'UPLOADFILE' . ' ' . $this-file . ''; The file name attribute is not properly sanitized when returned to the client, therefore allowing the execution of malicious...
CVE-2025-24018 YesWiki Vulnerable to Authenticated Stored XSS
YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for an authenticated user with rights to edit/create a page or comment to trigger a stored XSS which will be reflected on any page where the resource is loaded. The vulnerability makes use of the conten...
CVE-2025-24018 YesWiki Vulnerable to Authenticated Stored XSS
YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for an authenticated user with rights to edit/create a page or comment to trigger a stored XSS which will be reflected on any page where the resource is loaded. The vulnerability makes use of the conten...
PT-2025-2142 · Google · Google Chrome
Name of the Vulnerable Software and Affected Versions: Gravity Forms plugin for WordPress versions 2.9.0.1 through 2.9.1.3 Description: The issue concerns a Stored Cross-Site Scripting vulnerability via the style settings parameter due to insufficient input sanitization and output escaping. This...
GHSA-W6XH-C82W-H997 Mattermost webapp crash via a crafted post
Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel...
CVE-2025-20621
Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel...
CVE-2025-20630 Mobile crash via object that can't be cast to String in Attachment Field
Mattermost Mobile versions =2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the mobile to crash via creating and sending such a post to a channel...
