CVE-2024-50649

The CVE-2024-50649 entry describes an arbitrary file upload vulnerability in the user avatar upload function of python_book V1.0. Affected component: user avatar upload handler in python_book. Root cause: arbitrary file upload capability enabling potentially unsafe files to be uploaded. Impact: a...

CVE-2024-50652

A file upload vulnerability in javashop 1.0 allows attackers to upload arbitrary files by modifying the avatar function...

Prison Management System 1.0 Authenticated RCE via Unrestricted File Upload

This module exploits an unrestricted file upload vulnerability in Prison Management System 1.0. An authenticated user can upload a PHP file with arbitrary content by abusing the avatar upload functionality in the add-admin.php endpoint. The application fails to properly validate the uploaded file...

GO-2024-3158 Apache Answer: Avatar URL leaked user email addresses in github.com/apache/incubator-answer

Apache Answer: Avatar URL leaked user email addresses in github.com/apache/incubator-answer...

GHSA-48CR-J2CX-MCR8 Apache Answer: Avatar URL leaked user email addresses

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommend...

Apache Answer: Avatar URL leaked user email addresses

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommend...

CVE-2024-40761 Apache Answer: Avatar URL leaked user email addresses

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommend...

CVE-2024-8341

A vulnerability classified as critical was found in SourceCodester Petshop Management System 1.0. This vulnerability affects unknown code of the file /controllers/adduser.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be initiated remotely. The exploit h...

SourceCodester Petshop Management System 代码问题漏洞

SourceCodester Petshop Management System is SourceCodester open source a pet store management system . A code issue exists in version 1.0 of the SourceCodester Petshop Management System, which is caused by an unrestricted file upload vulnerability in the avatar parameter of the...

PT-2024-38956 · Sourcecodester · Sourcecodester Petshop Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Petshop Management System version 1.0 Description: A critical issue was found in the SourceCodester Petshop Management System. This issue affects the code in the file /controllers/add user.php. The manipulation of the avatar...

GHSA-XP68-7G33-F49M FeehiCMS User[avatar] unrestricted upload

A vulnerability was found in FeehiCMS up to 2.1.1 and classified as critical. This issue affects the function insert of the file /admin/index.php?r=user%2Fcreate. The manipulation of the argument Useravatar leads to unrestricted upload. The attack may be initiated remotely. The exploit has been...

PT-2024-38923 · Feehicms · Feehicms

Name of the Vulnerable Software and Affected Versions: FeehiCMS versions up to 2.1.1 Description: A critical issue affects the insert function of the file /admin/index.php?r=user%2Fcreate. The manipulation of the argument Useravatar leads to unrestricted upload. The attack may be initiated...

FeehiCMS 代码问题漏洞

FeehiCMS is a Php based CMS website builder by Liufee personal developer. A code issue vulnerability exists in FeehiCMS version 2.1.1 and prior versions, which originates from an unverified file upload vulnerability in the Useravatar parameter of the /admin/index.php?r=user%2Fcreate file...

PT-2024-38677 · Unknown · Codeastro Online Railway Reservation System

Name of the Vulnerable Software and Affected Versions: CodeAstro Online Railway Reservation System version 1.0 Description: A critical issue was found in the CodeAstro Online Railway Reservation System, affecting some unknown functionality of the file /admin/emp-profile-avatar.php of the componen...

The vulnerability of the GLPI system’s request and incident handling process, related to incorrect input cancellation during the generation of web pages, allows attackers to carry out attacks using cross-site scripting.

The vulnerability of the GLPI system’s request and incident handling functionality lies in the lack of cleaning during the loading of SVG files, as well as the integration of JavaScript into user avatars. Exploiting this vulnerability allows a malicious actor to carry out an attack using cross-si...

CVE-2024-6958

A vulnerability classified as critical was found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /stupdate.php of the component Avatar File Handler. The manipulation of the argument personalimage leads to unrestricted upload. The attack can be...

CVE-2024-6958 itsourcecode University Management System Avatar File st_update.php unrestricted upload

A vulnerability classified as critical was found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /stupdate.php of the component Avatar File Handler. The manipulation of the argument personalimage leads to unrestricted upload. The attack can be...

CVE-2024-6958 itsourcecode University Management System Avatar File st_update.php unrestricted upload

A vulnerability classified as critical was found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /stupdate.php of the component Avatar File Handler. The manipulation of the argument personalimage leads to unrestricted upload. The attack can be...

CVE-2024-6945

A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been classified as critical. This affects an unknown part of the file app/Core/Http/Controllers/Profile/ImagesController.php of the component Avatar Upload Page. The manipulation of the argument avatar leads to unrestricted upload. It i...

CVE-2024-6945

Flute CMS 0.2.2.4-alpha contains a critical flaw in the Avatar Upload Page component, affecting the file app/Core/Http/Controllers/Profile/ImagesController.php. The vulnerability arises from manipulating the avatar parameter, enabling unrestricted remote upload. Multiple sources confirm exploitat...