19 matches found
EUVD-2026-91851
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475: Improper Neutralization of Input During Web Page Generation
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475
IDURAR ERP CRM, versions through 4.1.1 , is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the application's failure to sanitize SVG files during the upload process. Authenticated users can exploit this by uploading JavaScript-laden SVGs via the profile update or settin...
CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
PT-2026-104457
Name of the Vulnerable Software and Affected Versions IDURAR ERP CRM versions prior to 4.1.2 Description Authenticated users can perform stored cross-site scripting by uploading unsanitized SVG files. This occurs when JavaScript-laden SVGs are uploaded via the profile update or settings upload...
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php...
SUSE CVE-2025-49113
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization...
CVE-2023-4613
LG LED Assistant is affected by CVE-2023-4613, a path traversal vulnerability in the /api/settings/upload endpoint. The flaw stems from inadequate validation of a user-supplied path used in file operations, enabling remote attackers to execute arbitrary code in the current user context. Public de...
CVE-2021-36461
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...
CVE-2021-36461
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...
CVE-2021-36461
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...
CVE-2021-36461
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...
CVE-2021-36461: Unrestricted Upload of File with Dangerous Type
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...
PT-2022-10516
Name of the Vulnerable Software and Affected Versions Microweber version 1.1.3 Description An Arbitrary File Upload issue exists, allowing attackers to upload pictures with malicious code, such as user.ini, via the Settings Upload Picture section, potentially leading to unauthorized access...
CVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host’s filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid...
PT-2014-4942
Name of the Vulnerable Software and Affected Versions Dell SonicWALL Email Security versions 7.4.5 and earlier Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML. This can be achieved via the uploadPatch parameter to the "System/Advanced" page...