4 matches found
GHSA-Q769-PHQG-263R VaahCMS is vulnerable to XSS through its Avatar Upload endpoint
Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...
VaahCMS is vulnerable to XSS through its Avatar Upload endpoint
Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...
CVE-2025-61183
VaahCMS 2.3.1 is affected by a Stored XSS via the Avatar Upload endpoint in storeAvatar() of UserBase.php. The vulnerability stems from saving the uploaded file to a public path before content/MIME-type validation, allowing an attacker to place a crafted SVG that can execute script when rendered....
