CVE-2025-9145: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in Scada-LTS 2.7.8.1. This issue affects some unknown processing of the file viewedit.shtm of the component SVG File Handler. Such manipulation of the argument backgroundImageMP leads to cross site scripting. The attack can be launched remotely. The...

Malicious code in svg-presentation (npm)

The package svg-presentation was found to contain malicious code...

Malicious code in svg-config-viewer (npm)

The package svg-config-viewer was found to contain malicious code...

Malicious code in svg-mixer-test (npm)

The package svg-mixer-test was found to contain malicious code...

Malicious code in grunt-vox-svg-prepper (npm)

The package grunt-vox-svg-prepper was found to contain malicious code...

Malicious code in svg-page-browser (npm)

The package svg-page-browser was found to contain malicious code...

MAL-2025-34253 Malicious code in svg-config-viewer (npm)

The package svg-config-viewer was found to contain malicious code...

MAL-2025-34255 Malicious code in svg-page-browser (npm)

The package svg-page-browser was found to contain malicious code...

MAL-2025-34254 Malicious code in svg-mixer-test (npm)

The package svg-mixer-test was found to contain malicious code...

MAL-2025-34256 Malicious code in svg-presentation (npm)

The package svg-presentation was found to contain malicious code...

MAL-2025-22003 Malicious code in grunt-vox-svg-prepper (npm)

The package grunt-vox-svg-prepper was found to contain malicious code...

svg-sanitizer 输入验证错误漏洞

svg-sanitizer is a SVG format file cleaning tool by the individual developer Daryll Doyle. An input validation error vulnerability exists in versions of svg-sanitizer prior to 0.22.0, which stems from the cleanXlinkHrefs method searching only for lowercase attribute names, which could lead to...

CVE-2025-55006 Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature

Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content...

CVE-2025-55006

Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content...

CVE-2025-55006: Improper Input Validation

Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately sanitize uploaded SVG files. This allowed users to upload SVG files containing embedded JavaScript or other potentially malicious content...

Linux Distros Unpatched Vulnerability : CVE-2017-7806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free vulnerability can occur when the layer manager is freed too early when rendering specific SVG content, resulting in a potentially exploitable...

Adult sites trick users into Liking Facebook posts using a clickjack Trojan

As the use of age verification to access adult websites increases in various countries around the world, shady websites with adult content have started a timely malware-fueled campaign to promote links to their own websites. During our daily rounds on Facebook, looking for the latest scams, we...

BIT-OPENCART-2025-45893

OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting XSS attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded...

CVE-2025-55135

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG...

CVE-2025-55135

CVE-2025-55135 affects Agora Foundation Agora fall23-Alpha1 prior to patch 690ce56. The issue stems from insufficient file type validation in server/routes/userRoutes.js, allowing non-supported formats (including SVG) for profile pictures and enabling XSS via server/controller/userController.js. ...