1939 matches found
CVE-2025-2219 LoveCards LoveCardsV2 image unrestricted upload
A vulnerability was found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This issue affects some unknown processing of the file /api/upload/image. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been...
CVE-2025-2219 LoveCards LoveCardsV2 image unrestricted upload
A vulnerability was found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This issue affects some unknown processing of the file /api/upload/image. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been...
Leantime allows Refelected Cross-Site Scripting (XSS)
Summary The vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation...
CVE-2024-13741 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 5.9.4.2 via the pmuploadimage function. This makes it possible for authenticated attackers, with Subscriber-level access and abov...
CVE-2022-25037
An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting XSS vulnerability via the image upload function...
CVE-2024-56940
An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service DoS via excessive file uploads...
CVE-2024-56940
An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service DoS via excessive file uploads...
PT-2025-6732 · Learndash · Learndash
Name of the Vulnerable Software and Affected Versions: LearnDash version 6.7.1 Description: An issue in the profile image upload function of LearnDash allows attackers to cause a Denial of Service DoS via excessive file uploads. Recommendations: For LearnDash version 6.7.1, consider restricting...
LearnDash 安全漏洞
LearnDash is a learning management system from LearnDash, Inc. A security vulnerability exists in LearnDash version v6.7.1, which stems from a problem with the profile image upload feature that can cause a denial of service by uploading too many files...
CVE-2024-10239
A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6 . An attacker with administrator privileges can upload a specially crafted image, which can cause a stack overflow due to the unchecked fat-fsd.maxfld...
CVE-2025-24372
CVE-2025-24372 affects CKAN when a registered user uploads a specially crafted file, enabling execution of code that can trigger arbitrary server requests and potentially escalate privileges for the submitter or others. The issue is tied to user-upload handling and can be exploited if upload rest...
CVE-2024-29891
ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed image in th...
CVE-2024-1491
The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module provides a light-weight read-only file system that can be stored in external EEPROM, external serial flash, or internal flash program memory...
CVE-2024-10238
A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6. An attacker can upload a specially crafted image that will cause a stack overflow is caused by not checking fld-usedbytes...
CVE-2024-10238 fld->used_bytes without sanity check causes stack overflow
A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6. An attacker can upload a specially crafted image that will cause a stack overflow is caused by not checking fld-usedbytes...
CVE-2024-10238
CVE-2024-10238 affects Supermicro MBD-X12DPG-OA6 firmware image verification. The root cause is a stack overflow caused by not checking fld->used_bytes in the verification path. Public sources in the connected documents describe two related stack-overflow flaws in the firmware image verificati...
SuperMicro MBD-X12DPG-OA6 安全漏洞
The SuperMicro MBD-X12DPG-OA6 is a processor from SuperMicro USA. A security vulnerability exists in the Supermicro MBD-X12DPG-OA6. An attacker exploiting this vulnerability could upload a specially crafted image resulting in a stack overflow...
Supermicro MBD-X12DPG-OA6 安全漏洞
The SuperMicro MBD-X12DPG-OA6 is a processor from SuperMicro USA. A security vulnerability exists in the Supermicro MBD-X12DPG-OA6. An attacker exploiting this vulnerability could upload a specially crafted image resulting in a stack overflow...
Cross-site Scripting (XSS)
Overview backdrop/backdrop is a CMS that helps you build websites for businesses and non-profits. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient validation of uploaded SVG images. A user with SVG upload privileges who convinces another user to...
CVE-2025-25063
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, ...