CVE-2026-49247 Jellyfin: Potential Authenticated path traversal in /ClientLog/Document

Jellyfin is an open source self hosted media server. From 10.9.0 until 10.11.10, the POST /ClientLog/Document endpoint accepts the Authorization header's Client and Version fields and uses them unsanitized as components of the on-disk filename when persisting client-uploaded log documents. As a...

EUVD-2020-11207

Malware in sbrugna...

EUVD-2021-31709

Malicious code in bioql PyPI...

EUVD-2022-33432

Malicious code in bioql PyPI...

CVE-2024-24059

springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files...

CVE-2022-29001

In SpringBootMovie =1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability...

Design/Logic Flaw

springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files...

CVE-2024-24059

springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files...

PT-2024-20257

Name of the Vulnerable Software and Affected Versions springboot-manager version 1.6 Description The system does not filter the suffixes of uploaded files, allowing for Arbitrary File Upload. Recommendations For springboot-manager version 1.6, consider implementing file type validation to restric...

CVE-2023-40183

DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the "ImageIO.read" method to determine whether the file is an image file or not. There is no whitelistin...

Cross site scripting

fast-poster v2.15.0 is vulnerable to Cross Site Scripting XSS. File upload check binary of img, but without strictly check file suffix at /server/fast.py - ApiUploadHandler.post causes stored XSS...

fastposter 跨站脚本漏洞

fastposter is fastposter open source a rapid development of posters. fastposter v2.15.0 version has a security vulnerability , the vulnerability stems from the file upload check does not strictly check the file suffix , vulnerable to stored cross-site scripting XSS attacks...

CVE-2023-37658

fast-poster v2.15.0 is vulnerable to Cross Site Scripting XSS. File upload check binary of img, but without strictly check file suffix at /server/fast.py - ApiUploadHandler.post causes stored XSS...

PT-2022-19356

Name of the Vulnerable Software and Affected Versions SpringBootMovie versions 1.2 and earlier Description The issue is related to an arbitrary file upload vulnerability due to the uploaded file suffix parameter not being filtered. Recommendations For SpringBootMovie versions 1.2 and earlier, as ...

CVE-2021-44912

In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is...

Unrestricted file upload

XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restrict...

Cross site scripting

In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is...

PT-2022-12263

Name of the Vulnerable Software and Affected Versions XE versions prior to 1.11.2 XE version 1.116 Description The issue arises from the lack of restriction on file suffixes when uploading files using the Normal button, allowing any file type to be uploaded to the files directory. Since the...

Cross site scripting in kindeditor

Cross SIte Scripting XSS vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this editor the file suffix is allowed...

CVE-2021-42227

CVE-2021-42227 describes a cross‑site scripting (XSS) vulnerability in KindEditor 4.1.x . The weakness is triggered via the editor’s upload flow, specifically related to the file handling in the upload context (e.g., an upload_json.php path) and exposure through a Google search result pointing to...