CVE-2026-65650

CVE-2026-65650 — PoC: Authenticated DoS in Elgg Avatar Upload Authenticated denial of service in Elgg's avatar upload feature via unbounded image dimensions, causing GD memory exhaustion. Affected: Elgg saveIconFromUploadedFile'avatar' return elggerrorresponseelggecho'avatar:resize:fail'; PHP's G...

CVE-2025-25599

CVE-2025-25599 Details Bolt is an open-source content management system built using the Symfony PHP framework. During a short security assessment, Certitude identified several vulnerabilities including an arbitrary file read. Users with the role EDITOR , CHIEFEDITOR , ADMIN , or DEVELOPER may abu...

CVE-2021-46067

CVE-2021-46067 Título del Exploit: Vehicle Service Management System - 'Múltiple' Robo de Cookies Conduce a la Toma Total de la Cuenta Autor del Exploit: SANU P.L CVE: CVE-2021-46067 CVSS: 9.8 CRÍTICO Referencias:...

CVE-2019-11447_CuteNews-AvatarUploadRCE

CVE-2019-11447 Exploit/PoC - CuteNews 2.1.2 Carga de avatar RCE Autenticado Código de Exploit para CVE-2019-11447 también conocido como CuteNews 2.1.2 Carga de avatar RCE Autenticado Enlaces del Exploit: Resultado esperado: Iniciar sesión/Registrar una cuenta, crear un archivo PHP seleccionado po...

cve-2019-11447

CVE-2019-11447 CutePHP Cute News 2.1.2 RCE PoC Target : 2.1.2 This PoC script is based on a simple implementation of the original exploit by BobbySox. The original exploit is an MSF module by Akuss. This script needs the target ip address or domain along with credentials and it will automatically...

CVE-2023-43838

CVE-2023-43838 Una vulnerabilidad de carga arbitraria de archivos en Personal Management System v1.4.64 permite a los atacantes ejecutar código arbitrario mediante la carga de un archivo SVG manipulado como avatar del perfil de un usuario. Información adicional 1. Cree alert.svg con el siguiente...

CVE-2021-42669

CVE-2021-42669 CVE-2021-42669 - Remote code execution via unrestricted file upload vulnerability in the Engineers online portal system. Technical description: A unrestricted file upload vulnerability exists in the Engineers Online Portal system. An attacker can leverage this vulnerability in orde...

CVE-2025-61183

CVE-2025-61183 XSS Almacenado en la Carga de Avatar de Usuario a través de Manejo Inseguro de SVG Resumen Se identificó una vulnerabilidad de Cross-Site Scripting XSS Almacenado en vaahcms, específicamente dentro de la interacción entre la lógica de carga de archivos en MediaController.php y el...

CVE-2019-11447-POC

sadnews CuteNews 2.1.2 - CVE-2019-11447 Prueba de Concepto POC por CRFSlick, descubierto por AkkuS Se descubrió un problema en CutePHP CuteNews 2.1.2. Un atacante puede infiltrarse en el servidor mediante el proceso de carga de avatar en el área de perfil a través del campo avatarfile hacia...

EUVD-2026-85728

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument...

CVE-2026-96678

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument...

CVE-2026-96678 weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument...

CVE-2026-96678

A path traversal vulnerability exists in the Avatar Upload component of weiqingwen spring-boot-forum (affected up to commit 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f). The flaw is located in the validate function within the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java, where ma...

CVE-2026-96678 weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument...

CVE-2026-96678: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument...

PT-2026-97613

Name of the Vulnerable Software and Affected Versions weiqingwen spring-boot-forum versions up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f Description A path traversal issue exists in the Avatar Upload component. A remote attacker can exploit this by manipulating the Username argument within the...

CVE-2026-91971

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

CVE-2026-91849

A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the component Avatar Upload. The manipulation of the argument File results in unrestricted upload. The attack can be executed remotely. Th...

CVE-2026-91849 WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload

A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the component Avatar Upload. The manipulation of the argument File results in unrestricted upload. The attack can be executed remotely. Th...

EUVD-2026-78672

A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the component Avatar Upload. The manipulation of the argument File results in unrestricted upload. The attack can be executed remotely. Th...