EUVD-2021-11587

Malware in sbrugna...

EUVD-2022-4561

Malicious code in bioql PyPI...

CVE-2025-56295

code-projects Computer Laboratory System 1.0 has a file upload vulnerability. Staff can upload malicious files by uploading PHP backdoor files when modifying personal avatar information and use web shell connection tools to obtain server permissions...

CVE-2019-10377

A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins...

CVE-2023-5277

A vulnerability, which was classified as critical, has been found in SourceCodester Engineers Online Portal 1.0. This issue affects some unknown processing of the file studentavatar.php. The manipulation of the argument change leads to unrestricted upload. The attack may be initiated remotely. Th...

CVE-2023-30791

Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript...

Hardcoded credentials

Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript...

PT-2020-18482 · Phpbb Limited · Phpbb

Name of the Vulnerable Software and Affected Versions: phpBB version 3.2.8 Description: The issue allows for a CSRF attack, which can be used to modify a group avatar. Recommendations: For phpBB version 3.2.8, update to a newer version that contains a fix for this issue...

CVE-2019-10377

A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins...

Code execution vulnerability in javapms

JAVAPMS is a JAVA Portal Management System JAVA Portal Management System for short, SpringMVC + Spring + Hibernate + Freemarker + Html5 + jQuery for the technical core architecture, for the majority of webmasters, software developers, program enthusiasts, web page designers, for individual...

Administrator can change avatar without establishing a Secure Administrator Session (WebSudo)

Administrator can click on avatar of another user and change the avatar. This doesn't require the administrator user to establish a websudo session...

PBBoard 2.1.4 - Multiple SQL Injections

Title: PBBoard v2.1.4 multiple SQLi Vulnerabilities Version: 2.1.4 Author/Found by: loneferret Software Site: http://www.pbboard.com/PBBoardv2.1.4.zip Other vulnerabilities: http://www.exploit-db.com/exploits/18937/ Date found: May 29th 2012 Tested on: Ubuntu Server 8.04 / PHP Version...