CVE-2012-3572

Open Source Competency Center OSCC MyMeeting 3.0.1 and earlier, and MyMesyuarat 09b-1, does not properly verify uploaded documents, which allows remote authenticated users to execute arbitrary PHP code via a crafted document...

CVE-2025-4533 JeecgBoot Document Library Upload zip unzipFile resource consumption

A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library Upload. The manipulation of the argument File leads to resource consumption. The...

CVE-2025-45388

Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting XSS in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been...

CVE-2025-45388

Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting XSS in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been...

CVE-2025-45388

Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting XSS in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been...

CVE-2025-45388: Improper Neutralization of Input During Web Page Generation

Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting XSS in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been...

CVE-2025-45388

Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting XSS in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been...

CVE-2025-45388

Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting XSS in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been...

CVE-2025-45388

Wagtail CMS version 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability within the document upload functionality. Attackers can inject malicious code into a PDF file ; when a user clicks the document within the CMS interface, the payload executes. The supplier disputes this, ...

PT-2025-20295 · Unknown · Wagtail Cms

Name of the Vulnerable Software and Affected Versions: Wagtail CMS version 6.4.1 Description: The issue is related to a Stored Cross-Site Scripting XSS in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface...

Wagtail CMS security vulnerabilities

Wagtail CMS is a content management system from Wagtail Open Source. A security vulnerability exists in Wagtail CMS version 6.4.1, which stems from a stored cross-site scripting attack due to the document upload feature...

Celk Sistemas Celk Saude Cross-site scripting vulnerabilities

Celk Sistemas Celk Saude is a health sector management software from Celk Sistemas, Brazil. A cross-site scripting vulnerability exists in Celk Sistemas Celk Saude version v.3.1.252.1, which originates from stored cross-site scripting and could lead to a remote attacker storing JavaScript code in...

PT-2024-36510 · Unknown · Piranha Cms

Name of the Vulnerable Software and Affected Versions: Piranha CMS version 11.1 Description: A file upload functionality in Piranha CMS allows authenticated remote attackers to upload a crafted PDF file to "/manager/media". This PDF can contain malicious JavaScript code, which is executed when a...

CVE-2024-55239

A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious urls with arbitrary javascript in the 'titulodocumento' parameter...

PT-2024-35440

Name of the Vulnerable Software and Affected Versions libre-chat version 0.0.6 Description The issue allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file, specifically in the upload documents method. Recommendations For libre-chat version 0.0.6, consid...

XSS through document upload

This report is not public...

Cross-site Scripting (XSS)

Overview tribalsystems/zenario is a Zenario is a web-based content management system for sites with one or many languages. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the PDF upload functionality. An attacker can inject malicious scripts that are executed in t...

CVE-2024-34452: Improper Neutralization of Input During Web Page Generation

CMSimpleXH 1.7.6 allows XSS by uploading a crafted SVG document...

PT-2024-26243 · Dootask · Dootask

Name of the Vulnerable Software and Affected Versions: dootask version 0.30.13 Description: The issue allows attackers to execute arbitrary code via uploading a crafted PDF file, exploiting an arbitrary file upload vulnerability. Recommendations: For dootask version 0.30.13, update to a version...

Leantime Systems Leantime Cross-Site Scripting Vulnerability

Leantime Systems Leantime is an open source project management system based on PHP and MySQL from Leantime Systems. A cross-site scripting vulnerability exists in Leantime version v3.0.6, which originates from a vulnerability that allows an attacker to execute arbitrary code by uploading a crafte...