100 matches found
CVE-2025-28355
CVE-2025-28355 经发现，https://github.com/Volmarg/personal-management-system 应用程序存在CSRF攻击漏洞，攻击者可执行的操作之一是诱骗合法用户发起跨站请求，从而修改其密码，使攻击者能够访问该应用程序。该漏洞需要浏览器的“SameSite”Cookie属性默认值为 none 的浏览器（如Firefox）才能利用。 向量字符串 : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS评分 : 4.7 概念验证 为进行演示，我将使用用户名 tester，并将其密码更改为...
CVE-2023-43838
CVE-2023-43838 个人管理系统（Personal Management System）v1.4.64 中存在一个任意文件上传漏洞，攻击者可通过将精心构造的 SVG 文件上传到用户个人资料的头像中，从而执行任意代码。 附加信息 1. 创建 alert.svg，内容如下： root@kitploit: alert"huntr.dev"; 2. 将 .SVG 托管在 Web 服务器上。 3. 将 .SVG 作为头像图片上传。 4. 当用户在新标签页中打开头像时，存储于 .SVG 文件中的 javascript 将被执行。 参考资料：...
CVE-2026-40526
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...
EUVD-2026-67124
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...
CVE-2026-40526 Volmarg Personal Management System Path Traversal via get-file Endpoint
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...
CVE-2023-43838
An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar...
EUVD-2025-11801
Malicious code in bioql PyPI...
EUVD-2025-12364
Malicious code in bioql PyPI...
EUVD-2025-12206
Malicious code in bioql PyPI...
EUVD-2025-12366
Malicious code in bioql PyPI...
EUVD-2023-48201
Malicious code in bioql PyPI...
EUVD-2025-12265
Malicious code in bioql PyPI...
EUVD-2025-11798
Malicious code in bioql PyPI...
EUVD-2024-26329
Malicious code in bioql PyPI...
EUVD-2023-37550
Malicious code in bioql PyPI...
CVE-2024-29318
Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting XSS via upload of a SVG file with embedded javascript code...
CVE-2024-29319
Volmarg Personal Management System 1.4.64 is vulnerable to SSRF Server Side Request Forgery via uploading a SVG file. The server can make unintended HTTP and DNS requests to a server that the attacker controls...
CVE-2025-29456
An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the create Notes function...