CVE-2024-52302

CVE-2024-52302: Vulnerabilità di Upload File Non Restrittivo in Common-User-Management Panoramica Ho scoperto una vulnerabilità di sicurezza critica in common-user-management , una robusta applicazione Spring Boot con servizi di gestione utenti progettati per controllare dinamicamente l'accesso...

CVE-2023-37790

CVE-2023-37790 Autor: KaizenSecurity Beschreibung: Es wurde festgestellt, dass Jaspersoft Clarity PPM Version 14.3.0.298 eine Schwachstelle für willkürliche Datei-Uploads über die Funktion zum Hochladen von Profilbildern enthält. 1. https://nvd.nist.gov/vuln/detail/CVE-2023-37790 2...

whatsfoto

WhatsFoto Ferramenta simples para baixar várias fotos de perfil do whatsapp. É uma extensão para o Chrome Instalação Baixe o zip ou a pasta e arraste para a sua extensão. Certifique-se de ativar o modo de desenvolvedor. Ou use um arquivo zip. Como usar Faça login em web.whatsapp.com Clique no...

User Profile Picture < 2.5.0 - Sensitive Information Disclosure

The REST API endpoint getusers in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less...

Langflow < 1.7.0 - Path Traversal

Langflow 1.7.1 contains a path traversal caused by insufficient filtering of foldername and filename parameters in downloadprofilepicture endpoint, letting attackers read secretkey across directories, exploit requires crafted request. id: CVE-2026-33497 info: name: Langflow 1.7.0 - Path Traversal...

CVE-2025-29017

CVE-2025-29017 - Esecuzione di codice remoto tramite caricamento immagine profilo in Internet Banking System 2.0.0 Descrizione Esiste una vulnerabilità di Esecuzione di Codice Remoto RCE in Code Astro Internet Banking System 2.0.0 a causa di una convalida impropria del caricamento dei file nel...

cve-2017-7269picture

Questo repository non contiene un README...

CVE-2025-65675

CVE-2025-65675 Stored Cross site scripting XSS Schwachstelle in Classroomio LMS 0.1.13 erlaubt authentifizierten Angreifern, beliebigen Code über manipulierte SVG-Profilbilder auszuführen. Entdeckt von - Rivek Raj Tamang RivuDon, Sikkim, Indien. Betroffenes Produkt: ClassroomIO Betroffene Version...

CVE-2025-2502

Scoperto accidentalmente durante lo studio dell'elevazione dei privilegi locali. In qualsiasi versione del Lenovo PC Manager, gli strumenti hanno una vulnerabilità di autorizzazione: qualsiasi strumento scaricato concede all'utente normale il permesso F controllo completo. Poiché gli strumenti di...

Chrome-Skia-CVE-2024-8198

Corretto in Chrome M128: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop28.html Passaggi per riprodurre: 1. Applica la patch chromium.diff a chromium. 2. Esegui genskpic.py per generare drawablepicture.skp.hh, quindi sposta il file generato in...

CVE-2026-64969

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

EUVD-2026-63370

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-64969

ATutor (last confirmed vulnerable at v2.2.4) has an IDOR flaw in its profile album endpoint: any authenticated user can POST another user's member_id and permanently delete that user's profile picture, including instructors and administrators. The product is no longer supported and unpatched. CVS...

CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim...

CVE-2026-23603 Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim...

Malicious code in dolyame-boxy-independent-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c2f5f635baa82fb1cc166956476dc3d7560c0c5d9e49a29aa4123256fdd9310 On require of the package, index.js unconditionally loads bootstrap.js, which selects a platform-specific endpoint and downloads an opaque binary fro...

CVE-2026-54020 Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticat...

CVE-2026-17940

An insufficient validation of untrusted input flaw was found in the Picture-in-Picture component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514069440...