CVE-2022-39197

CVE-2022-39197 RCE POC Enlaces de referencia https://mp.weixin.qq.com/s/Eb0pQ-1ebLSKPUFC7zS6dg — Hay un gran análisis en profundidad de esta vulnerabilidad https://www.agarri.fr/blog/archives/2012/05/11/svgfilesandjavacodeexecution/index.html...

Rocky Linux 8 [CIQ] Security Update: librsvg2 / librsvg2-debuginfo / librsvg2-debugsource / etc (crlsa-2020_4709)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20204709 advisory. librsvg: Resource exhaustion via crafted SVG file with nested patterns CVE-2019-20446 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (ALMALINUX9.6:CLSA-2026:1771498382)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1771498382 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to...

Rocky Linux 10.2 [CIQ] Security Update: qt6-qtdeclarative / qt6-qtdeclarative-debuginfo / etc (crlsa-2026_20567)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202620567 advisory. qt: Qt SVG: Arbitrary QML/JavaScript code injection via malicious SVG file CVE-2025-14576 Tenable has extracted the preceding description block directly from th...

Rocky Linux 8 [CIQ] Security Update: adwaita-qt-debuginfo / adwaita-qt5 / adwaita-qt5-debuginfo / etc (crlsa-2021_4172)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214172 advisory. qt: Out of bounds read in function QRadialFetchSimd from crafted svg file CVE-2021-3481 Tenable has extracted the preceding description block directly from the CIQ...

AlmaLinux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (ALMALINUX9.6:CLSA-2026:1771498382)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1771498382 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to...

CVE-2025-14564

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

EUVD-2025-211018

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

CVE-2025-14564 Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

CVE-2025-14564 Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

CVE-2025-14564

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.0 . The root cause is insufficient input sanitization and output escaping during SVG file uploads. An authenticated attacker with Author-level access or hi...

AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (ALMALINUX9.2:CLSA-2026:1771497630)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1771497630 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to...

CVE-2022-32074

CVE-2022-32074 para osTicket | Sistema de Ticketing de Soporte 1. Find the file listing directory, the root of the file download directoryм fileuploads this is an example. 2. Load the following xssPayload.svg and open it Ejemplo:...

CVE-2026-97062 Aureus ERP 1.6.0 Stored XSS via SVG File Upload

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the...

CVE-2026-97062 Aureus ERP 1.6.0 Stored XSS via SVG File Upload

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the...

CVE-2026-97062

Aureus ERP versions up to and including 1.6.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The application allows authenticated users to upload SVG files that are stored on a public disk and served from the application's origin. An attacker can craft a malicious SVG containing scri...

CVE-2026-94150

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-94150 Omega Solution HRM OS SVG File Upload view cross site scripting

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...

EUVD-2026-83863

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-94150 Omega Solution HRM OS SVG File Upload view cross site scripting

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...