Joomla! ChronoForums 2.0.11 - Local File Inclusion Detection

Joomla! ChronoForums 2.0.11 avatar function is vulnerable to local file inclusion through unauthenticated path traversal attacks. This enables an attacker to read arbitrary files, for example the Joomla! configuration file which contains credentials. !/usr/bin/env python3 -- coding: utf-8 --...

EUVD-2026-38796

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.getavatar function...

CVE-2026-50700

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.getavatar function...

PT-2026-51826

Name of the Vulnerable Software and Affected Versions Frappe Framework version 17.0.0-dev Description A Stored Cross-Site Scripting XSS issue occurs due to improper neutralization of user-controlled input within the frappe.get avatar function during image rendering. Stored XSS is a type of...

EUVD-2026-5803

A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible t...

EUVD-2007-1720

Malware in sbrugna...

EUVD-2022-3403

Malicious code in bioql PyPI...

EUVD-2025-11802

Malicious code in bioql PyPI...

WordPress plugin WP User Frontend Pro has a path traversal vulnerability

WordPress WP User Frontend Pro plugin is a WordPress front-end user center plugin that provides powerful front-end administration features. WordPress WP User Frontend Pro plugin has a path traversal vulnerability that stems from insufficient file path validation in the deleteavatarajax function. ...

CVE-2024-50652

A file upload vulnerability in javashop 1.0 allows attackers to upload arbitrary files by modifying the avatar function...

CVE-2025-29458

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...

CVE-2025-29458

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...

CVE-2025-29458

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...

CVE-2025-29458

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...

CVE-2025-29458

The MyBB forum creation software (version 1.8.38 ) contains a vulnerability in the Change Avatar (or Import Avatar ) function. This issue is caused by insufficient validation of requests on the server side, which may allow a remote attacker to gain unauthorized access to sensitive information . W...

PT-2025-17240 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.38 Description: An issue in MyBB allows a remote attacker to obtain sensitive information via the Change Avatar function. The supplier disputes this due to the allowed actions of Board administrators and SSRF mitigation...

CVE-2024-50652

A file upload vulnerability in javashop 1.0 allows attackers to upload arbitrary files by modifying the avatar function...

CVE-2024-50652

A file upload vulnerability in javashop 1.0 allows attackers to upload arbitrary files by modifying the avatar function...

CVE-2024-50652: Unrestricted Upload of File with Dangerous Type

A file upload vulnerability in javashop 1.0 allows attackers to upload arbitrary files by modifying the avatar function...

PT-2024-34380 · Java Shop · Java Shop

Name of the Vulnerable Software and Affected Versions: java shop version 1.0 Description: A file upload issue allows attackers to upload arbitrary files by modifying the avatar function. This enables them to upload any file they want by changing the avatar function. Recommendations: For java shop...