CVE-2025-3169 Projeqtor saveAttachment.php unrestricted upload

A vulnerability was found in Projeqtor up to 12.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tool/saveAttachment.php. The manipulation of the argument attachmentFiles leads to unrestricted upload. The attack may be launched remotely. The...

CVE-2025-3169

A vulnerability was found in Projeqtor up to 12.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tool/saveAttachment.php. The manipulation of the argument attachmentFiles leads to unrestricted upload. The attack may be launched remotely. The...

CVE-2025-3169: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in Projeqtor up to 12.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tool/saveAttachment.php. The manipulation of the argument attachmentFiles leads to unrestricted upload. The attack may be launched remotely. The...

CVE-2021-42940

A Cross Site Scripting XSS vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code...

Cross site scripting

A Cross Site Scripting XSS vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code...

CVE-2021-42940

Projeqtor 9.3.1 is affected by a Cross Site Scripting (XSS) vulnerability via /projeqtor/tool/saveAttachment.php, allowing an attacker to upload an SVG containing malicious JavaScript. This can enable script execution in the context of the vulnerable application (per CVSS notes: high impact on co...

CVE-2021-42940: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code...

PT-2022-11746

Name of the Vulnerable Software and Affected Versions Projeqtor version 9.3.1 Description A Cross Site Scripting XSS issue exists, allowing an attacker to upload a SVG file containing malicious JavaScript code via the "/projeqtor/tool/saveAttachment.php" API endpoint. This enables the execution o...