bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)

Summary In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. Details The underlying probl...

Arbitrary Code Injection

Overview @cocalc/frontend is a CoCalc: Collaborative Calculation Affected versions of this package are vulnerable to Arbitrary Code Injection via uploading a crafted SVG file. An attacker can execute arbitrary code by uploading a specially crafted SVG file. Remediation A fix was pushed into the...

Arbitrary Code Injection

Overview @cocalc/hub is a CoCalc: Backend webserver component Affected versions of this package are vulnerable to Arbitrary Code Injection via uploading a crafted SVG file. An attacker can execute arbitrary code by uploading a specially crafted SVG file. Remediation A fix was pushed into the mast...

CVE-2025-62418

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the...

CVE-2025-62418 bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the...

CVE-2025-10700

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enableunfilteredfilesupload function. This makes it possible for unauthenticated...

CVE-2025-10700

CVE-2025-10700 concerns the WordPress plugin Ally – Web Accessibility & Usability (versions up to 3.8.0). The issue is Cross-Site Request Forgery caused by missing/incorrect nonce validation in enable_unfiltered_files_upload, allowing unauthenticated attackers to trick an admin into enabling unfi...

EUVD-2025-34704

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enableunfilteredfilesupload function. This makes it possible for unauthenticated...

PT-2025-42403

Name of the Vulnerable Software and Affected Versions Ally – Web Accessibility & Usability plugin for WordPress versions prior to 3.8.1 Description The Ally – Web Accessibility & Usability plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by inadequate nonce...

CoCalc 安全漏洞

CoCalc is a web-based software from CoCalc, Inc. that enables collaboration in research, teaching, and scientific publishing. A security vulnerability exists in versions prior to CoCalc 0d2ff58 that stems from inadequate validation when uploading specially crafted SVG files, which could lead to t...

CVE-2025-61514: Improper Neutralization of Special Elements used in a Command

An arbitrary file upload vulnerability in SageMath, Inc CoCalc before commit 0d2ff58 allows attackers to execute arbitrary code via uploading a crafted SVG file...

PT-2025-42531

Name of the Vulnerable Software and Affected Versions SageMath CoCalc versions prior to commit 0d2ff58 Description An arbitrary file upload issue exists in SageMath CoCalc. Successful exploitation allows attackers to execute arbitrary code by uploading a specially crafted SVG file. Recommendation...

Webkul Software Bagisto 安全漏洞

Webkul Software Bagisto is an open source e-commerce framework from the Indian company Webkul Software. A security vulnerability exists in Webkul Software Bagisto version 2.3.7, which stems from the TinyMCE image upload feature that allows the upload of specially crafted SVG files, which could le...

CVE-2025-62418: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the...

PT-2025-42537

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.8 Bagisto version 2.3.7 Description The TinyMCE image upload functionality allows an attacker with sufficient privileges to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code...

CVE-2025-59428

EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit...

libQt6Svg6-6.10.0-1.1 on GA media (moderate)

libQt6Svg6-6.10.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15630-1 Rating: moderate Cross-References: CVE-2025-10728 CVE-2025-10729 CVSS scores: CVE-2025-10728 SUSE : 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CVE-2025-10729 SUSE : 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H...

CVE-2025-59428

EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit...

EUVD-2025-34207

EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit...

CVE-2025-59428

CVE-2025-59428 affects EspoCRM up to version 9.1.8. A combination of stored SVG injection and missing CSRF protection allows an attacker with Knowledge Base edit permissions to cause arbitrary user creation (including admin accounts) by luring an authenticated user to click a malicious SVG link t...