CVE-2019-11447-POC

sadnews CuteNews 2.1.2 - CVE-2019-11447 Prueba de Concepto POC por CRFSlick, descubierto por AkkuS Se descubrió un problema en CutePHP CuteNews 2.1.2. Un atacante puede infiltrarse en el servidor mediante el proceso de carga de avatar en el área de perfil a través del campo avatarfile hacia...

CVE-2026-65650

CVE-2026-65650 — PoC: Authenticated DoS in Elgg Avatar Upload Authenticated denial of service in Elgg's avatar upload feature via unbounded image dimensions, causing GD memory exhaustion. Affected: Elgg saveIconFromUploadedFile'avatar' return elggerrorresponseelggecho'avatar:resize:fail';...

CVE-2019-11447_CuteNews-AvatarUploadRCE

CVE-2019-11447 Exploit/PoC - CuteNews 2.1.2 Carga de avatar RCE Autenticado Código de Exploit para CVE-2019-11447 también conocido como CuteNews 2.1.2 Carga de avatar RCE Autenticado Enlaces del Exploit: Resultado esperado: Iniciar sesión/Registrar una cuenta, crear un archivo PHP seleccionado po...

cve-2019-11447

CVE-2019-11447 CutePHP Cute News 2.1.2 RCE PoC Objetivo : 2.1.2 Este script de PoC está basado en una implementación simple del exploit original por BobbySox. El exploit original es un módulo MSF por Akuss. Este script necesita la dirección IP o dominio del objetivo junto con credenciales, y...

CVE-2025-25599

CVE-2025-25599 Detalles Bolt es un sistema de gestión de contenidos de código abierto construido utilizando el framework Symfony PHP. Durante una breve evaluación de seguridad, Certitude identificó varias vulnerabilidades, incluyendo una lectura arbitraria de archivos. Los usuarios con el rol...

CVE-2021-46067

CVE-2021-46067 Exploit Title: Vehicle Service Management System - 'Multiple' Cookie Stealing Leads to Full Account Takeover Exploit Author: SANU P.L CVE: CVE-2021-46067 CVSS: 9.8 CRITICAL References:...

CVE-2023-43838

CVE-2023-43838 Una vulnerabilidad de carga arbitraria de archivos en Personal Management System v1.4.64 permite a los atacantes ejecutar código arbitrario mediante la carga de un archivo SVG manipulado como avatar del perfil de un usuario. Información adicional 1. Cree alert.svg con el siguiente...

CVE-2021-42669

CVE-2021-42669 CVE-2021-42669 - Ejecución remota de código mediante vulnerabilidad de carga de archivos sin restricciones en el sistema de portal en línea de ingenieros. Descripción técnica: Existe una vulnerabilidad de carga de archivos sin restricciones en el sistema de Portal en Línea de...

CVE-2025-61183

CVE-2025-61183 XSS Almacenado en la Carga de Avatar de Usuario a través de Manejo Inseguro de SVG Resumen Se identificó una vulnerabilidad de Cross-Site Scripting XSS Almacenado en vaahcms, específicamente dentro de la interacción entre la lógica de carga de archivos en MediaController.php y el...

CVE-2026-82607

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...

CVE-2026-82607 Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...

EUVD-2026-68329

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...

CVE-2026-82599

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

CVE-2026-82599 SeaCMS Avatar Upload member.php unlink path traversal

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

CVE-2026-82599

SeaCMS versions up to 13.6 are affected by a path traversal vulnerability in the Avatar Upload component. The flaw resides in the unlink function of /member.php?action=chgpwdsubmit, where manipulation of the oldpic argument allows a remote attacker with low privileges to delete arbitrary files. T...

EUVD-2026-68302

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

CVE-2026-72594

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...

CVE-2026-72594 lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...

EUVD-2026-55164

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...

CVE-2026-72594

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...