14108 matches found
CVE-2024-8029
CVE-2024-8029 applies to imartinez/privategpt v0.5.0 and is a Stored XSS in the file upload path. The root cause is the ability to upload SVG files that contain JavaScript, which is executed when a user clicks the link, enabling data theft, session hijacking, malware distribution, or phishing as ...
CVE-2024-8029
An XSS vulnerability was discovered in the upload files process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks...
CVE-2024-8029 Stored XSS in imartinez/privategpt
An XSS vulnerability was discovered in the upload files process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks...
Exploit for Cross-site Scripting in Inflectra Spirateam
CVE-2024-48591 Vulnerability Disclosure: XSS in Inflectra S...
Cross-site Scripting (XSS)
modx/revolution is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper file validation due to authenticated users being able to upload SVG files containing malicious JavaScript, which executes in victims' browsers when viewing the profile image...
PT-2025-12113
Name of the Vulnerable Software and Affected Versions langgenius/dify affected versions not specified Description A stored cross-site scripting XSS issue exists due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit th...
CVE-2024-11850: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG...
CVE-2024-48591
Inflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting XSS. A specially crafted SVG file can be uploaded that will render and execute JavaScript upon direct viewing...
PrivateGPT Cross-Site Scripting Vulnerability
PrivateGPT is an AI project open-sourced by Zylon. A cross-site scripting vulnerability exists in PrivateGPT version v0.5.0, which stems from cross-site scripting during file uploads, which allows an attacker to upload a malicious SVG file and execute JavaScript when the victim clicks on the file...
CVE-2024-48591
Inflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting XSS. A specially crafted SVG file can be uploaded that will render and execute JavaScript upon direct viewing...
PT-2025-12352
Name of the Vulnerable Software and Affected Versions Inflectra SpiraTeam version 7.2.00 Description The issue allows a specially crafted SVG file to be uploaded, which can render and execute JavaScript when viewed directly, potentially leading to Cross Site Scripting XSS attacks. Recommendations...
CVE-2024-48591: Improper Neutralization of Input During Web Page Generation
Inflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting XSS. A specially crafted SVG file can be uploaded that will render and execute JavaScript upon direct viewing...
CVE-2024-48591
Inflectra SpiraTeam version 7.2.00 is vulnerable to Cross-Site Scripting (XSS) via the TestRuns section. An attacker can upload a specially crafted SVG file containing JavaScript; when a user views this file directly in their browser, the script executes. This vulnerability could potentially lead...
CVE-2024-8029: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability was discovered in the upload files process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks...
Regular Expression Denial of Service (ReDoS)
Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the addImage, html, and addSvgAsImage methods. An attacker can occupy excessive CPU by supplying a malicious data-url. PoC js import jsPDF from "jpsdf" const doc = new jsPDF; const payload =...
Regular Expression Denial of Service (ReDoS)
Overview org.webjars:jspdf is a WebJar for jspdf. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the addImage, html, and addSvgAsImage methods. An attacker can occupy excessive CPU by supplying a malicious data-url. PoC js import jsPDF from "jpsd...
Regular Expression Denial of Service (ReDoS)
Overview org.webjars.bowergithub.parallax:jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the addImage, html, and addSvgAsImage methods. An attacker can occupy excessive CPU by supplying a malicious...
GHSA-VQQR-FGMH-F626 Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads
Impact Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. Patches Update to Contao 4.13.54, 5.3.30 or 5.5.6. Workarounds Remove svg,svgz from the allowed upload file types in the system settings and from contao.editablefiles in the config.yaml...
Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads
Impact Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. Patches Update to Contao 4.13.54, 5.3.30 or 5.5.6. Workarounds Remove svg,svgz from the allowed upload file types in the system settings and from contao.editablefiles in the config.yaml...
