VaahCMS is vulnerable to XSS through its Avatar Upload endpoint

Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...

GHSA-Q769-PHQG-263R VaahCMS is vulnerable to XSS through its Avatar Upload endpoint

Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...

CVE-2025-61183

VaahCMS version 2.3.1 is vulnerable to Stored Cross-Site Scripting (XSS) via the storeAvatar() method in UserBase.php. The root cause is a race condition where files are physically saved to a predictable public path (/storage/media/YYYY/MM/.svg) before content or MIME-type validation occurs. An a...

CVE-2025-61183

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...