CVE-2024-13286: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal SVG Embed allows Cross-Site Scripting XSS.This issue affects SVG Embed: from 0.0.0 before 2.1.2...

Drupal security vulnerabilities

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal SVG Embed prior to version 2.1.2, which stems from improper input neutralization during page generation, resulting in a cross-site scripting...

Drupal security vulnerabilities

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Views SVG Animation prior to version 1.0.1, which stems from improper input neutralization during page generation, resulting in a cross-site scriptin...

CVE-2024-13287: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting XSS.This issue affects Views SVG Animation: from 0.0.0 before 1.0.1...

CVE-2024-6155: Missing Authorization

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated Subscriber+ Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshiftdownloadfilelocaly function...

CVE-2024-12328

The MAS Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, ...

CVE-2024-12328 MAS Elementor <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

The MAS Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, ...

CVE-2024-12328 MAS Elementor <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

The MAS Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, ...

CVE-2024-12328

CVE-2024-12328 affects MAS Elementor for WordPress. The flaw is Stored XSS via SVG uploads in all versions up to 1.1.7, exploitable by authenticated attackers with Author+ privileges to inject scripts that run when a user views the SVG. Connected sources indicate Patch Status: Patched; ongoing gu...

PT-2025-1818

Name of the Vulnerable Software and Affected Versions MAS Elementor plugin for WordPress versions up to, and including, 1.1.7 Description The issue is related to Stored Cross-Site Scripting via SVG file uploads, which is possible due to insufficient input sanitization and output escaping. This...

WordPress plugin MAS Elementor has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-12328: Improper Neutralization of Input During Web Page Generation

The MAS Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, ...

WordPress MAS Elementor plugin <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG vulnerability discovered by Ryan Zegar in WordPress Plugin MAS Elementor versions = 1.1.7...

CVE-2025-21616

Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

CVE-2025-21616

CVE-2025-21616 — Plane XSS via SVG upload . Plane is affected when running versions prior to 0.23. The vulnerability arises through profile image uploads: an authenticated user can upload an SVG containing malicious JavaScript, which is executed in other users’ browsers when viewing the affected ...

CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload

Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload

Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload

Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

qt:qtbase_gui_image_qimage_loadfromdata: Bad-cast to const QSvgPolyline from QSvgPolygon in QSvgMarker::drawHelper

Detailed Report: https://oss-fuzz.com/testcase?key=4907860466663424 Project: qt Fuzzing Engine: libFuzzer Fuzz Target: qtbaseguiimageqimageloadfromdata Job Type: libfuzzerubsanqt Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5cda4a1c8d30 Crash State: Bad-cast to const QSvgPolyline from...

PT-2025-4302

Name of the Vulnerable Software and Affected Versions Plane versions prior to 0.23 Description A cross-site scripting XSS vulnerability has been identified in Plane. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets...