PT-2025-49207

Name of the Vulnerable Software and Affected Versions Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress versions prior to 7.10.1322 Description The software is susceptible to a Cross-Site Request Forgery issue. This is due to...

Toeverything AFFiNE 代码注入漏洞

Toeverything AFFiNE is a knowledge management software from Toeverything open source. AFFiNE 0.24.1 and earlier versions suffer from a code injection vulnerability that stems from an unknown code flaw in the Avatar Upload Image Endpoint component, which could lead to a cross-site scripting attack...

CVE-2025-11945: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload Image Endpoint. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. The...

EUVD-2019-18296

Malware in sbrugna...

EUVD-2019-17691

Malware in sbrugna...

EUVD-2020-18678

Malware in sbrugna...

EUVD-2019-3350

Malware in sbrugna...

EUVD-2023-1574

Malicious code in bioql PyPI...

EUVD-2021-31658

Malicious code in bioql PyPI...

EUVD-2025-25656

Malicious code in bioql PyPI...

EUVD-2025-26395

Malicious code in bioql PyPI...

CVE-2025-41031

Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnovac/FotoUsuario/llamadaAjax/uploadImage’...

CVE-2025-41031

CVE-2025-41031 affects Deporsite by T-INNOVA. The root cause is a lack of authorization that allows an unauthenticated attacker to change other users’ profile pictures by sending a POST request to /ajax/TInnova_c/FotoUsuario/llamadaAjax/uploadImage with IdPersona and Foto. The CVE entry lists a C...

CVE-2025-41031 Multiple vulnerabilities in Deporsite by T-INNOVA

Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnovac/FotoUsuario/llamadaAjax/uploadImage’...

CVE-2025-41031 Multiple vulnerabilities in Deporsite by T-INNOVA

Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnovac/FotoUsuario/llamadaAjax/uploadImage’...

CVE-2025-9406

A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...

CVE-2025-9406

A vulnerability is identified in xuhuisheng lemon up to 1.13.0 affecting the uploadImage function in CmsArticleController.java (com.mossle.cms.web.CmsArticleController.uploadImage). The Upload argument is manipulated to enable unrestricted uploads, with remote initiation and a publicly available ...

CVE-2025-9406 xuhuisheng lemon CmsArticleController.java uploadImage unrestricted upload

A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...

CVE-2025-9406 xuhuisheng lemon CmsArticleController.java uploadImage unrestricted upload

A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be...

PT-2025-34592 · Unknown · Xuhuisheng Lemon

Name of the Vulnerable Software and Affected Versions: xuhuisheng lemon versions through 1.13.0 Description: A weakness exists in xuhuisheng lemon up to version 1.13.0. This issue affects the uploadImage function within the CmsArticleController.java file, specifically in the...