CVE-2026-72576

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...

CVE-2026-72576

CVE-2026-72576 : Bludit 4.0.0-beta contains a stored XSS vulnerability exploitable by a low-privileged authenticated user (Author) who uploads a crafted SVG as the site logo. The flaw resides in the /admin/ajax/logo-upload.php path, which moves the uploaded file directly to the web root via Files...

SolidInvoice 跨站脚本漏洞

SolidInvoice is an open-source invoice processing application developed by SolidInvoice. Versions of SolidInvoice prior to 2.3.17 contained a cross-site scripting vulnerability. This vulnerability stemmed from the company logo upload feature not verifying file types. As a result, authenticated...