CVE-2025-65675

CVE-2025-65675 Stored Cross site scripting XSS vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India. Affected Product: ClassroomIO Affected Version: 0.1.13...

User Profile Picture < 2.5.0 - Sensitive Information Disclosure

The REST API endpoint getusers in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less...

Langflow < 1.7.0 - Path Traversal

Langflow 1.7.1 contains a path traversal caused by insufficient filtering of foldername and filename parameters in downloadprofilepicture endpoint, letting attackers read secretkey across directories, exploit requires crafted request. id: CVE-2026-33497 info: name: Langflow 1.7.0 - Path Traversal...

CVE-2024-52302

CVE-2024-52302: Unrestricted File Upload Vulnerability in Common-User-Management Overview I discovered a critical security vulnerability in common-user-management , a robust Spring Boot application featuring user management services designed to control user access dynamically. This vulnerability...

CVE-2025-29017

CVE-2025-29017 - Internet Banking System 2.0.0 Remote Code Execution via Profile Picture Upload Description A Remote Code Execution RCE vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profilepic parameter within pagesviewclient.php...

VulnCheck KEV: CVE-2026-4882

The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAFAJAX::methodupload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary...

CVE-2023-37790

CVE-2023-37790 Author: KaizenSecurity Description: Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload function. 1. https://nvd.nist.gov/vuln/detail/CVE-2023-37790 2. https://vuldb.com/?id.244831 3...

CVE-2026-47679

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...

CVE-2026-47679

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...

CVE-2026-47679 GLPI: arbitrary file deletion

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...

CVE-2026-47679

The GLPI asset and IT management software package is vulnerable to arbitrary file deletion due to insufficient path validation in the profile-picture update flow. Any authenticated user can exploit this flaw to request the deletion of an attacker-selected file hosted on the server. This issue aff...

CVE-2026-47679 GLPI: arbitrary file deletion

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...

CVE-2026-47679 GLPI: arbitrary file deletion

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...

EUVD-2026-87284

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...

PT-2026-99065

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.0 through 10.0.25 GLPI versions prior to 11.0.8 Description Insufficient path validation in the profile-picture update flow allows any logged-in user to request the deletion of an arbitrary file hosted on the server selected...

CVE-2026-47679: Improper Limitation of a Pathname to a Restricted Directory

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...

CVE-2026-91005

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function moveuploadedfile of the file production/editpicture.php of the component Profile Picture Upload. Performing a manipulation of the argument File results in unrestricted upload. The attack is...

CVE-2026-91005

SourceCodester Online Faculty Clearance System 1.0 is vulnerable to an unrestricted file upload in the Profile Picture Upload component. The flaw resides in the move_uploaded_file function within production/edit_picture.php , where manipulation of the File argument allows an attacker to upload ar...

EUVD-2026-78299

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function moveuploadedfile of the file production/editpicture.php of the component Profile Picture Upload. Performing a manipulation of the argument File results in unrestricted upload. The attack is...

CVE-2026-91005 SourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted upload

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function moveuploadedfile of the file production/editpicture.php of the component Profile Picture Upload. Performing a manipulation of the argument File results in unrestricted upload. The attack is...