8620 matches found
EUVD-2025-32492
The Ultimate Addons for Elementor Formerly Elementor Header & Footer Builder WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability...
CVE-2025-60448
A stored Cross-Site Scripting XSS vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file uploads in the /admin/media.php component, allowing attackers to upload malicious SVG files containing JavaScript code that executes when th...
CVE-2025-60450
A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to...
CVE-2025-60451
A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\uploadify.class.php component, specifically in the website settings module...
CVE-2025-60454
A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, specifically in the app\system\img\admin\imgadmin.class.php component. The vulnerability allows attackers to upload malicious SVG files containi...
PT-2025-40617
Name of the Vulnerable Software and Affected Versions WP Photo Album Plus plugin for WordPress versions prior to 9.0.11.006 Description The WP Photo Album Plus plugin for WordPress is susceptible to Cross-Site Scripting due to inadequate input sanitization and output escaping within the wppa user...
CVE-2025-61681
KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exploited for stored XSS. The upload endpoint only validates file types based on Content-Type headers, lacks file content analysis and...
CVE-2025-61681 Kuno is Vulnerable to Stored XSS Attack via SVG File Upload
KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exploited for stored XSS. The upload endpoint only validates file types based on Content-Type headers, lacks file content analysis and...
EUVD-2025-32427
KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exploited for stored XSS. The upload endpoint only validates file types based on Content-Type headers, lacks file content analysis and...
EUVD-2024-17071
Malicious code in bioql PyPI...
EUVD-2025-28373
Malicious code in bioql PyPI...
EUVD-2024-17425
Malicious code in bioql PyPI...
EUVD-2024-33722
Malicious code in bioql PyPI...
EUVD-2025-22109
Malicious code in bioql PyPI...
EUVD-2025-31328
Malicious code in bioql PyPI...
EUVD-2024-0757
Malicious code in bioql PyPI...
EUVD-2024-49740
Malicious code in bioql PyPI...
EUVD-2023-41856
Malicious code in bioql PyPI...