1306 matches found
CVE-2023-44763_ConcreteCMS-Arbitrary-file-upload-Thumbnail
ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: ConcreteCMS v9.2.1 is affected by Arbitrary File Upload vulnerability which allows Cross-Site Scriting XSS stored. Attack Vectors: A vulnerability in "Thumbnail" file upload sanitation allows you to upload a PDF / SVG /HTML file with hidd...
LG LED Assistant - Thumbnail Path Traversal File Upload
A path traversal vulnerability exists in the endpoint handler for /api/thumbnail in Common.js. An unauthenticated remote attacker can exploit this to upload arbitrary files to any location on the disk drive where the product is installed. id: CVE-2024-2863 info: name: LG LED Assistant - Thumbnail...
CVE-2026-26833
CVE-2026-26833: OS command injection in thumbler Summary thumbler through version 1.1.2 allows OS command injection in thumbnail in lib/thumbler.js. The package concatenates the input, output, time, and size values into a single ffmpeg command string and executes that string with childprocess.exe...
CVE-2025-32140
🚨 CVE-2025-32140 – WP Remote Thumbnail Exploit Arbitrary File Upload 📝 Description CVE-2025-32140 is a critical vulnerability in the WP Remote Thumbnail plugin for WordPress. It enables authenticated attackers with contributor or higher permissions to upload arbitrary files , such as web shells ,...
LG Supersign EZ CMS - Remote Code Execution
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsrserver/device/getThumbnail. id: CVE-2018-17173 info: name: LG Supersign EZ CMS - Remote Code Execution author: pussycat0x severity: critical description: | LG SuperSign CMS allows remote attackers...
CVE-2024-53615
CVE-2024-53615 A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file. Prerequisites: ffmpeg in PATH config.php: 'allowupload' = true exec must be...
Exploit for CVE-2026-112403
CVE-2026-112403: Pillow Heap Buffer Overflow via Lossless JPEG...
mailpit -- Unbounded CPU and memory consumption in thumbnail endpoint via cyclic EXIF IFD chain
Mailpit author reports: The thumbnail endpoint GET /api/v1/message/ID/part/PartID/thumb parses EXIF metadata of image attachments with github.com/rwcarlsen/goexif to apply orientation. goexif's TIFF IFD walker only detects a self-referencing IFD next == prev. An attachment whose IFD chain forms a...
DEBIAN-CVE-2026-114723
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...
CVE-2026-114723
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...
CVE-2026-114723
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...
CVE-2026-114723
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...
CVE-2026-114723
Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a resource limit bypass during thumbnail generation. When the rcube_image component falls back to GD , the available-memory check is only applied on Windows. On other platforms, a crafted image with large dimensions...
CVE-2026-114723
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...
EUVD-2026-107700
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...
CVE-2026-114723
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...
Linux Distros Unpatched Vulnerability : CVE-2026-114723
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls...
PT-2026-120955
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...
CVE-2012-20002
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like...