CVE-2022-25037

An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting XSS vulnerability via the image upload function...

CVE-2022-25037

An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting XSS vulnerability via the image upload function...

PT-2024-11531 · Waneditor · Waneditor

Name of the Vulnerable Software and Affected Versions: wanEditor version 4.7.11 Description: The issue is related to a cross-site scripting XSS vulnerability via the image upload function. This vulnerability allows for malicious scripts to be injected into the application, potentially leading to...

GHSA-VG6X-PCHQ-98MG OpenCMS Cross-Site Scripting vulnerability

Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user: with sufficient privileges to create and modify web pages through the admin panel, can execute malicious JavaScript code, after inserting code in the title field...

CVE-2024-5518

A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown part of the file changeprofilepicture.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit ha...

CVE-2024-5521

The CVE-2024-5521 entry describes stored Cross-Site Scripting in Alkacon OpenCMS 16 via SVG file uploads. The root cause is improper validation of .svg images, which, when uploaded by users with gallery editor or VFS resource manager roles, allows JavaScript in the SVG to execute when another use...

CVE-2024-5521 Cross-Site Scripting stored in Alkacon OpenCMS

Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user having the roles of gallery editor or VFS resource manager will have the permission to upload images in the .svg format containing JavaScript code. The code will be...

WordPress SVGMagic plugin <= 1.1 - Authenticated Stored XSS via SVG Upload vulnerability

Authenticated Stored XSS via SVG Upload vulnerability discovered by Rayhan Ramdhany Hanaputra in WordPress Plugin SVGMagic versions = 1.1...

inxedu 安全漏洞

Inxedu inxedu is a set of open source online education platform from China's Inxu Times Inxedu company. The platform includes an online school system, a live broadcasting system, an examination system and a marketing website. inxedu v2.0.6 version of a security vulnerability , the vulnerability...

PT-2024-26551 · Inxedu · Inxedu

Name of the Vulnerable Software and Affected Versions: inxedu version 2.0.6 Description: The issue is related to an arbitrary file upload vulnerability in the ImageUploadController.class component. This allows attackers to execute arbitrary code by uploading a crafted jsp file. Recommendations: F...

CVE-2024-4966

A vulnerability was found in SourceCodester SchoolWebTech 1.0. It has been classified as critical. Affected is an unknown function of the file /improve/home.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...

CVE-2024-4921

A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of the file /employeegatepass/classes/Users.php?f=ssave. The manipulation of the argument img leads to unrestricted upload. It is possible to...

PT-2024-33611 · Unknown · Sourcecodester Schoolwebtech

Name of the Vulnerable Software and Affected Versions: SourceCodester SchoolWebTech version 1.0 Description: A critical issue has been found, affecting an unknown function of the file /improve/home.php. The manipulation of the image argument leads to unrestricted upload. This issue can be exploit...

CVE-2024-3606

The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pmuploadcoverimage function in all versions up to, and including, 5.8.3. This makes it possible for authenticated...

CVE-2024-3581

The MaxGalleria plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the addmedialibraryimagestogallery function in all versions up to, and including, 6.4.2. This makes it possible for authenticated attackers, with subscriber access or above, to...

CVE-2023-7064

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.15.2 via deserialization of untrusted input from the vulnerable 'id' parameter in the 'auxintemplatecontrolimporter' function. This makes it possibl...

CVE-2023-7064

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.17.5 via deserialization of untrusted input from the vulnerable 'id' parameter in the 'auxintemplatecontrolimporter' function. This makes it possibl...

CVE-2024-3581 MaxGalleria <= 6.4.2 - Missing Authorization

The MaxGalleria plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the addmedialibraryimagestogallery function in all versions up to, and including, 6.4.2. This makes it possible for authenticated attackers, with subscriber access or above, to...

CVE-2024-3581

CVE-2024-3581 affects the MaxGalleria WordPress plugin. The issue is an unauthorized image upload flaw caused by a missing capability check in add_media_library_images_to_gallery, affecting all versions up to and including 6.4.2. Exploitation requires authentication with at least Subscriber privi...

CVE-2024-3581 MaxGalleria <= 6.4.2 - Missing Authorization

The MaxGalleria plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the addmedialibraryimagestogallery function in all versions up to, and including, 6.4.2. This makes it possible for authenticated attackers, with subscriber access or above, to...