PT-2025-3065 · Flatnotes · Flatnotes

Name of the Vulnerable Software and Affected Versions: Flatnotes versions prior to 5.3.1 Description: The issue is related to a denial of service through the upload image function. There is no information provided about the estimated number of potentially affected devices worldwide or real-world...

flatnotes 安全漏洞

flatnotes is a self-hosted, database-less notes web application by the individual developer Adam Dullage. A security vulnerability exists in flatnotes version v5.3.1 that originates from a denial of service via the upload image feature...

PT-2025-3896 · Opencart · Blog Botz For Journal Theme

Name of the Vulnerable Software and Affected Versions: Blog Botz for Journal Theme version 1.0 on OpenCart Description: A critical vulnerability was found in Blog Botz for Journal Theme on OpenCart, affecting an unknown part of the file /index.php?route=extension/module/blog add. The manipulation...

CVE-2025-0335

A vulnerability was found in code-projects Online Bike Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component Change Image Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been...

CVE-2025-0335

A vulnerability was found in code-projects Online Bike Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component Change Image Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been...

CVE-2025-0335

The CVE-2025-0335 entry concerns code-projects Online Bike Rental System 1.0, where the Change Image Handler component exposes an unrestricted upload path. The documented impact is remote, with the ability to upload arbitrary files, leading to a high-severity outcome (per multiple sources). Concr...

Code-Projects Content Management System 代码问题漏洞

Code-Projects Content Management System is an open source content and management system from Code-Projects. A code issue exists in Code-Projects Content Management System version 1.0 due to an unrestricted upload of the parameter image...

CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload

Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload

Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

WordPress plugin MStore API 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2024-12233

A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processing of the file /registration.php of the component Profile Picture Handler. The manipulation of the argument img leads to unrestricted upload. The attack may...

CVE-2024-11661

A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file profile.php of the component Profile Image Handler. The manipulation of the argument image leads to unrestricted upload. The...

CVE-2024-10482

The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-51208

File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the Image Upload Mechanism parameter...

CVE-2024-51208

File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the Image Upload Mechanism parameter...

CVE-2024-51208

The CVE concerns Anuj Kumar's Boat Booking System v1.0 where the vulnerable component is change-image.php’s Image Upload Mechanism parameter. The issue is a File Upload vulnerability that lets local attackers upload a malicious PHP script, enabling potential code execution on the system. Exploita...

CVE-2024-51208

File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the Image Upload Mechanism parameter...

PHPGurukul Boat Booking System 安全漏洞

PHPGurukul Boat Booking System is a boat booking system from PHPGurukul. A security vulnerability exists in version 1.0 of the PHPGurukul Boat Booking System, which stems from an Image Upload Mechanism parameter in change-image.php that allows a local attacker to upload malicious PHP scripts...

PT-2024-34560 · Unknown · Anuj Kumar'S Boat Booking System

Name of the Vulnerable Software and Affected Versions: Anuj Kumar's Boat Booking System version 1.0 Description: The issue allows local attackers to upload a malicious PHP script via the Image Upload Mechanism parameter in the change-image.php file. This enables attackers to potentially execute...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the Create User process, which involves uploading a profile image. An attacker can exploit this by uploading a malicious SVG file containing a maliciously crafted script, which executes when the profile...