CVE-2025-3169 Projeqtor saveAttachment.php unrestricted upload

A vulnerability was found in Projeqtor up to 12.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tool/saveAttachment.php. The manipulation of the argument attachmentFiles leads to unrestricted upload. The attack may be launched remotely. The...

Cross site scripting

A Cross Site Scripting XSS vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code...

CVE-2021-42940

Projeqtor 9.3.1 is affected by a Cross Site Scripting (XSS) vulnerability via /projeqtor/tool/saveAttachment.php, allowing an attacker to upload an SVG containing malicious JavaScript. This can enable script execution in the context of the vulnerable application (per CVSS notes: high impact on co...