CVE-2025-56694

Client-side password validation CWE-602 in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums...

CVE-2025-56694

Client-side password validation CWE-602 in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums...

CVE-2025-56694

The CVE-2025-56694 affects lumasoft fotoShare Cloud (version 2025-03-13). The vulnerability is a client-side password validation issue (CWE-602) that could allow unauthenticated attackers to view password-protected photo albums. Root cause appears to be improper client-side validation. CVSS v3.1 ...

CVE-2025-56694

Client-side password validation CWE-602 in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums...

CVE-2025-50977

A template injection vulnerability leading to reflected cross-site scripting XSS has been identified in version 1.7.1, requiring authenticated admin access for exploitation. The vulnerability exists in the 'r' parameter and allows attackers to inject malicious Angular expressions that execute...

PT-2025-34871 · Lumsoft · Fotoshare Cloud

Name of the Vulnerable Software and Affected Versions: lumasoft fotoShare Cloud version 2025-03-13 Description: The software exhibits a client-side password validation issue, which allows unauthenticated attackers to view password-protected photo albums. Recommendations: At the moment, there is n...

CVE-2025-50977

Gitblit (version 1.7.1) contains a template injection vulnerability that enables reflected XSS via the r parameter. Exploitation requires authenticated admin access and can be triggered through GET requests to the /summary endpoint or POST requests to certain Wicket interfaces, enabling injection...

Linux Distros Unpatched Vulnerability : CVE-2020-13262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on...

@copart/ops-tool-kit (>=1.10.20-alpha.15, <=1.13.0), @firedesktop/react-portal-base (>=0.1.46, <=0.1.52) +6 more potentially affected by CVE-2025-57810 via jspdf (>=3.0.0, <=3.0.1)

jspdf NPM version =3.0.0, =1.10.20-alpha.15, =0.1.46, =0.54.4-nightly, =0.47.5-MYUN-38209, =1.1.63, =7.3.5, =7.3.8 Source cves: CVE-2025-57810 Source advisory: SNYK:JS-JSPDF-12205531...

CVE-2025-55743

UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy...

CVE-2025-51990

XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting XSS vulnerabilities in the Administration interface, specifically under the Presentation section of the Global Preferences panel. An authenticated administrator can inject arbitrary JavaScript payloads into the HTTP...

CVE-2025-55743

UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy...

CVE-2025-55743

UnoPim (Laravel-based PIM) is vulnerable to Remote Code Execution via Arbitrary File Upload, due to insufficient client-side validation of image uploads in the user-creation flow. Attackers can craft and replace an uploaded image (e.g., poc.php) to execute code when accessed. The issue is fixed i...

CVE-2025-55743 UnoPim vulnerable to remote code execution through Arbitrary File upload

UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy...

CVE-2025-55743 UnoPim vulnerable to remote code execution through Arbitrary File upload

UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy...

CVE-2025-55743 UnoPim vulnerable to remote code execution through Arbitrary File upload

UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy...

GHSA-V22V-XWH7-2VRM UnoPim vulnerable to remote code execution through Arbitrary File upload

Summary: Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create Details The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy lik...

UnoPim vulnerable to remote code execution through Arbitrary File upload

Summary: Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create Details The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy lik...

UnoPim 代码问题漏洞

UnoPim is an open source Product Information Management PIM system based on the Laravel framework by UnoPim Open Source. A code issue vulnerability exists in versions of UnoPim prior to 0.2.1 that stems from insufficient validation of client-side file types, which could lead to the upload of...

CVE-2025-51990

XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting XSS vulnerabilities in the Administration interface, specifically under the Presentation section of the Global Preferences panel. An authenticated administrator can inject arbitrary JavaScript payloads into the HTTP...