EUVD-2026-5803

A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible t...

EUVD-2007-1720

Malware in sbrugna...

EUVD-2025-11802

Malicious code in bioql PyPI...

EUVD-2022-3403

Malicious code in bioql PyPI...

WordPress plugin WP User Frontend Pro 路径遍历漏洞

WordPress WP User Frontend Pro plugin is a WordPress front-end user center plugin that provides powerful front-end administration features. WordPress WP User Frontend Pro plugin has a path traversal vulnerability that stems from insufficient file path validation in the deleteavatarajax function. ...

CVE-2024-50652

A file upload vulnerability in javashop 1.0 allows attackers to upload arbitrary files by modifying the avatar function...

CVE-2025-29458

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...

CVE-2025-29458

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...

CVE-2025-29458

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...

CVE-2025-29458

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...

CVE-2025-29458

CVE-2025-29458 concerns MyBB 1.8.38. The vulnerability arises in the Change Avatar feature, which can allow a remote attacker to obtain sensitive information. Root cause: mishandling of Change Avatar functionality (per multiple sources); supplier disputes relate to administrator actions and SSRF ...

PT-2025-17240 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.38 Description: An issue in MyBB allows a remote attacker to obtain sensitive information via the Change Avatar function. The supplier disputes this due to the allowed actions of Board administrators and SSRF mitigation...

CVE-2024-50652

A file upload vulnerability in javashop 1.0 allows attackers to upload arbitrary files by modifying the avatar function...

CVE-2024-50652

The CVE-2024-50652 entry concerns a file upload vulnerability in java_shop 1.0 that allows an attacker to upload arbitrary files by manipulating the avatar function. Multiple connected sources provide concrete details: the vulnerability affects java_shop 1.0 and enables arbitrary file upload, wit...

CVE-2024-50652

A file upload vulnerability in javashop 1.0 allows attackers to upload arbitrary files by modifying the avatar function...

CVE-2024-50652

A file upload vulnerability in javashop 1.0 allows attackers to upload arbitrary files by modifying the avatar function...

java_shop 安全漏洞

javashop is a Java-based mall website system designed and implemented by Tim Green, an individual developer. A security vulnerability exists in javashop version 1.0. An attacker can exploit the vulnerability to upload arbitrary files by modifying the avatar function...

PT-2024-34380 · Java Shop · Java Shop

Name of the Vulnerable Software and Affected Versions: java shop version 1.0 Description: A file upload issue allows attackers to upload arbitrary files by modifying the avatar function. This enables them to upload any file they want by changing the avatar function. Recommendations: For java shop...

Privilege escalation

72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2021-44093

CVE-2021-44093 affects zrlog 2.2.2. A Remote Command Execution vulnerability exists in the avatar upload function, allowing bypass of the original limit and uploading a JSP file to obtain a WebShell. Multiple sources (NVD/NVDC, CNVD, Red Hat, CNVD, CNNVD, CVE listing) corroborate the issue and it...