4 matches found
Cross-site Scripting
webreinvent/vaahcms is vulnerable to Cross-Site Scripting. The vulnerability is due to improper sanitization in the storeAvatar upload method of UserBase.php, where crafted input can be stored and later executed in a user’s browser, allowing a remote attacker to run arbitrary JavaScript code...
6.1CVSS7.1AI score0.00279EPSS
SaveExploits2References4Affected Software1
CVE-2025-61183
Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...
6.1CVSS7.2AI score0.00279EPSS
SaveExploits2References1
20