562 matches found
CVE-2022-32074
CVE-2022-32074 for osTicket | Support Ticketing System 1. Find the file listing directory, the root of the file download directoryм fileuploads this is an example. 2. Load the following xssPayload.svg and open it Example:...
PT-2026-103764
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...
CVE-2025-14564 Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...
CVE-2025-14564 Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...
CVE-2025-14564
The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.0 . The root cause is insufficient input sanitization and output escaping during SVG file uploads. An authenticated attacker with Author-level access or hi...
PT-2026-103075
Name of the Vulnerable Software and Affected Versions Viable URL Media Uploader versions prior to 1.0.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with Author-level access and above to perform Stored Cross-Site Scripting XSS. This occurs through...
CVE-2026-97062 Aureus ERP 1.6.0 Stored XSS via SVG File Upload
Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the...
CVE-2026-97062
Aureus ERP versions up to and including 1.6.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The application allows authenticated users to upload SVG files that are stored on a public disk and served from the application's origin. An attacker can craft a malicious SVG containing scri...
CVE-2026-97062 Aureus ERP 1.6.0 Stored XSS via SVG File Upload
Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the...
CVE-2026-97062 Aureus ERP 1.6.0 Stored XSS via SVG File Upload
Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the...
CVE-2026-94150
A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...
CVE-2026-94150 Omega Solution HRM OS SVG File Upload view cross site scripting
A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...
CVE-2026-94150 Omega Solution HRM OS SVG File Upload view cross site scripting
A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...
CVE-2026-94150
CVE-2026-94150 is a cross-site scripting (XSS) flaw in Omega Solution HRM OS versions up to 20260717 , located in an unknown function of the SVG File Upload component at /media/view/. The attack can be initiated remotely but requires high privileges and user interaction , resulting in a low integ...
EUVD-2026-83863
A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...
PT-2026-96053
Name of the Vulnerable Software and Affected Versions Omega Solution HRM OS versions prior to 20260717 Description A security flaw in the SVG File Upload component allows for remote cross site scripting XSS, a technique where malicious scripts are injected into trusted websites. The issue resides...
CVE-2026-94150: Improper Neutralization of Input During Web Page Generation
A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...
EUVD-2026-75207
zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting XSS via SVG file upload through the /equipmentFile/upload endpoint...