Lucene search
+L

51912 matches found

CVE
CVE
added 1 hour ago8 views

CVE-2026-60011

Sharp and Toshiba Tec MFPs multifunction printers fail to properly authorize requests to directly access certain image data stored to the affected product...

6.9CVSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 5 hours ago2 views

CVE-2026-6695

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA Paint Shop Pro Array image file. This vulnerability, a heap-based out-of-bounds write in the decodelzss function of the PAA file format plugin, allows data to be written beyond t...

5.5CVSS6.2AI score
SaveExploits0References3
CVE
CVE
added 5 hours ago12 views

CVE-2026-6695

CVE-2026-6695 affects GIMP via the PAA file format plugin. The root cause is a heap-based out-of-bounds write in the decode_lzss() routine when processing crafted PAA images, which could corrupt heap metadata and allow arbitrary code execution. Documents specify the vulnerability as remote code e...

5.5CVSS6.2AI score
SaveExploits0References2
EUVD
EUVD
added 5 hours ago2 views

EUVD-2026-52151

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA Paint Shop Pro Array image file. This vulnerability, a heap-based out-of-bounds write in the decodelzss function of the PAA file format plugin, allows data to be written beyond t...

5.5CVSS6.2AI score
SaveExploits0References2
CVE
CVE
added 5 hours ago10 views

CVE-2026-6694

CVE-2026-6694 affects GIMP’s file-png plugin. A crafted APNG with an oversized tRNS chunk may trigger a stack-based buffer overflow (CWE-121), causing the plugin to crash and resulting in a Denial of Service. The available documents specify the vulnerability and impact but do not provide remediat...

5.5CVSS5.9AI score
SaveExploits0References2
CVE
CVE
added 7 hours ago6 views

CVE-2026-20486

In the provided documents, CVE-2026-20486 affects the imgsensor component. The root cause is an incorrect error handling in imgsensor that can trigger an application crash, potentially enabling local escalation of privilege for an attacker already holding System privileges. Exploitation does not ...

5.5AI score
SaveExploits0References1
NVD
NVD
added yesterday9 views

CVE-2026-12231

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS0.00256EPSS
SaveExploits0References5
CVE
CVE
added yesterday12 views

CVE-2026-12231

CVE-2026-12231 affects the WordPress plugin Exclusive Addons for Elementor . The vulnerability is a Stored Cross-Site Scripting via the exad_infobox_image parameter, present in all versions up to 2.7.9.8, due to insufficient input sanitization and output escaping. Exploitation requires authentica...

6.4CVSS5.7AI score0.00256EPSS
SaveExploits0References5
EUVD
EUVD
added yesterday12 views

EUVD-2026-51984

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS5.7AI score0.00256EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added yesterday6 views

CVE-2026-12231

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS5.7AI score0.00256EPSS
SaveExploits0References6
Cvelist
Cvelist
added yesterday20 views

CVE-2026-12231 Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS0.00256EPSS
SaveExploits0References5
NVD
NVD
added yesterday8 views

CVE-2025-15675

The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end...

0.00164EPSS
SaveExploits0References1
EUVD
EUVD
added yesterday8 views

EUVD-2025-210588

The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end...

5.6AI score0.00164EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added yesterday4 views

CVE-2025-15675

The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end...

5.6AI score0.00164EPSS
SaveExploits0References1
Nuclei
Nuclei
added yesterday60 views

EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

4.3CVSS5.4AI score0.01978EPSS
SaveExploits5References2
Nuclei
Nuclei
added yesterday41 views

CP Image Store with Slideshow <= 1.0.67 - SQL Injection

The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the orderingby query parameter before using it in a SQL statement in pages where the codepeople-image-store is embed, allowing unauthenticated users to perform an SQL injection attack. id: CVE-2022-1692...

9.8CVSS7.9AI score0.10577EPSS
SaveExploits2References3
Nuclei
Nuclei
added yesterday33 views

LolLMS < 2.2.0 - Server-Side Request Forgery

A Server-Side Request Forgery SSRF vulnerability exists in parisneo/lollms versions prior to 2.2.0. The /api/files/export-content endpoint processes Markdown image URLs by downloading them via downloadimagetotemp in backend/routers/files.py without any validation, allowing an unauthenticated...

7.5CVSS7.6AI score0.01765EPSS
SaveExploits2References3
Nuclei
Nuclei
added yesterday72 views

WordPress Simple Image Manipulator < 1.0 - Local File Inclusion

WordPress Simple Image Manipulator 1.0 is vulnerable to local file inclusion in ./simple-image-manipulator/controller/download.php because no checks are made to authenticate users or sanitize input when determining file location. id: CVE-2015-1000010 info: name: WordPress Simple Image Manipulator...

7.5CVSS7.2AI score0.0685EPSS
SaveExploits2References4
Nuclei
Nuclei
added yesterday88 views

Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting

Image Optimizer by 10web before 1.0.26 is susceptible to cross-site scripting via the iowdtabsactive parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can...

6.1CVSS6.6AI score0.0085EPSS
SaveExploits2References3
Nuclei
Nuclei
added yesterday81 views

WordPress Customize Login Image <3.5.3 - Cross-Site Scripting

WordPress Customize Login Image plugin prior to 3.5.3 contains a cross-site scripting vulnerability via the custom logo link on the Settings page. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks. id: CVE-2021-33851 info: name: WordPress Customi...

5.4CVSS5.7AI score0.01318EPSS
SaveExploits1References5
Rows per page
Query Builder