EUVD-2025-6166

Malicious code in bioql PyPI...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the mediapool/media page. An attacker can execute malicious code and potentially distribute malware by uploading a file with a modified filename and content-type to masquerade as a benign file type, then tricki...

CVE-2025-27411: Unrestricted Upload of File with Dangerous Type

REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3...

CVE-2018-18198: Improper Neutralization of Input During Web Page Generation

The $openerinputfield variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=XSS request...

CVE-2018-17830: Improper Neutralization of Input During Web Page Generation

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...