16 matches found
CVE-2022-51024
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to...
EUVD-2022-56068
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to...
CVE-2022-51024
Kavita versions 0.5.2 before 0.5.4.1 are vulnerable to a path traversal vulnerability. Unauthenticated attackers can read arbitrary files by providing ../ sequences in the filename parameter via GET requests to the /api/image/cover-upload endpoint. This allows for the retrieval of sensitive confi...
Cross-site Scripting (XSS) - DOM in janeczku/calibre-web
A Cross-site Scripting XSS vulnerability exists in janeczku/calibre-web, specifically in the file editbooks.js. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization,...
PYSEC-2026-1236 Cross-site Scripting (XSS) - DOM in janeczku/calibre-web
A Cross-site Scripting XSS vulnerability exists in janeczku/calibre-web, specifically in the file editbooks.js. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization,...
CVE-2026-1445
A vulnerability was found in iJason-Liu BooksManager up to 298ba736387ca37810466349af13a0fdf828e99c. This vulnerability affects unknown code of the file controllers/bookscenter/uploadbookCover.php. Performing a manipulation of the argument bookcover results in unrestricted upload. The attack may ...
EUVD-2024-51373
Malicious code in bioql PyPI...
CVE-2024-13140
A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=uploadcover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It is possible to launc...
CVE-2024-13140
A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=uploadcover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It is possible to launc...
CVE-2024-13140 Emlog Pro Cover Upload article.php cross site scripting
A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=uploadcover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It is possible to launc...
CVE-2024-13140 Emlog Pro Cover Upload article.php cross site scripting
A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=uploadcover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It is possible to launc...
CVE-2024-13140
A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=uploadcover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It is possible to launc...
CVE-2024-13140
CVE-2024-13140 affects Emlog Pro up to 2.4.3. A cross-site scripting vulnerability exists in the Cover Upload Handler, triggered by manipulating the image parameter in /admin/article.php?action=upload_cover. The flaw is exploitable remotely; public exploit appears in sources. Connected data confi...
PT-2025-2026 · Emlog Pro · Emlog Pro
Name of the Vulnerable Software and Affected Versions: Emlog Pro versions up to 2.4.3 Description: A problematic issue has been found in the Cover Upload Handler component, affecting an unknown function of the file /admin/article.php?action=upload cover. The manipulation of the image argument lea...
PT-2024-11005
Name of the Vulnerable Software and Affected Versions janeczku/calibre-web affected versions not specified Description A Cross-site Scripting XSS issue exists, specifically in the file edit books.js, when editing book properties, such as uploading a cover or a format. The affected code directly...
WS-2022-0259
An unauthenticated Path Traversal was found in kareadita/kavita. An unauthenticated user can read and download files of the application system by abusing the filename parameter, of the /api/image/cover-upload endpoint, that is not properly sanitized. This allows an attacker to read many files,...