SourceCodester Best Church Management Software 代码问题漏洞

SourceCodester Best Church Management Software is an open source church management software from SourceCodester. A code issue vulnerability exists in version 1.0 of SourceCodester Best Church Management Software, which stems from an incorrect manipulation of the parameter photo1 resulting in...

CVE-2024-56897

The CVE-2024-56897 issue affects YI Car Dashcam v3.88, caused by improper access control in the device’s HTTP server. This vulnerability allows unauthenticated attackers to perform unrestricted file downloads and uploads and to issue API commands that can modify device settings (e.g., disable rec...

CVE-2024-56897

Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made to make unauthorized modifications to the device settings, such as disabling recording, disabling sounds, factory reset...

CVE-2024-10222

The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

CVE-2024-13379

The C9 Admin Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

SourceCodester E-Learning System 代码问题漏洞

SourceCodester E-Learning System is a SourceCodester open source e-learning system. A code issue vulnerability exists in SourceCodester E-Learning System version 1.0, which stems from allowing unlimited file uploads...

SourceCodester Best Employee Management System 代码问题漏洞

SourceCodester Best Employee Management System is a SourceCodester open source employee management system. A code issue vulnerability exists in SourceCodester Best Employee Management System version 1.0, which stems from a lack of restrictions in the upload process, resulting in arbitrary file...

EUVD-2025-4422

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'uploadfiles' function in all versions up to, and including, 0.9.112. This makes it possible for authenticated attackers, with...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the overdue section due to improper input sanitization. An attacker can inject malicious scripts and compromise user data, session tokens, and potentially execute unauthorized actions on behalf of users by...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper handling of SVG uploads. An attacker can inject malicious scripts and potentially redirect users to malicious websites by uploading specially crafted SVG files. Details Cross-site scripting or XS...

Leantime allows Stored Cross-Site Scripting (XSS)

STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3...

GHSA-MG4C-884J-PCQ9 Leantime allows Stored Cross-Site Scripting (XSS)

STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3...

CVE-2024-10222

The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

CVE-2024-10222

CVE-2024-10222 affects the WordPress SVG Support plugin (versions up to 2.5.10). Root cause: insufficient input sanitization and output escaping for SVG uploads, enabling Stored XSS. Impact: authenticated attackers with Author-level access (potentially extended to Authors) can inject arbitrary sc...

CVE-2024-13379

The C9 Admin Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-13379

The C9 Admin Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-13379

CVE-2024-13379 affects the C9 Admin Dashboard WordPress plugin (versions

PT-2025-7648 · Leantime · Leantime

Name of the Vulnerable Software and Affected Versions: Leantime affected versions not specified Description: The issue concerns a STORED XSS and OPEN REDIRECTION vulnerability in SVG uploads. The vulnerable URL is https://hack.leantime.io/projects/showProject/3. Recommendations: At the moment,...

Education and Training System 代码问题漏洞

Education and Training System is an education and training system by the individual developer hzmanyun. A code issue exists in Education and Training System version 3.1.1, which stems from a lack of restrictions in the upload process, resulting in arbitrary file uploads...

PT-2025-7320 · WordPress · Svg Support Plugin

Name of the Vulnerable Software and Affected Versions: SVG Support plugin for WordPress versions up to and including 2.5.10 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated...