9470 matches found
CVE-2025-61769 Emlog vulnerable to stored XSS in file upload functionality in emlog
Emlog is an open source website building system. A cross-site scripting XSS vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload...
CVE-2025-61687 FlowiseAI/Flosise has File Upload vulnerability
Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables attackers to persistently store malicious Node.js web...
EUVD-2025-32492
The Ultimate Addons for Elementor Formerly Elementor Header & Footer Builder WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability...
CVE-2025-60448
A stored Cross-Site Scripting XSS vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file uploads in the /admin/media.php component, allowing attackers to upload malicious SVG files containing JavaScript code that executes when th...
CVE-2025-60454
A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, specifically in the app\system\img\admin\imgadmin.class.php component. The vulnerability allows attackers to upload malicious SVG files containi...
CVE-2025-60451
A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\uploadify.class.php component, specifically in the website settings module...
CVE-2025-60450
A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to...
PT-2025-40617
Name of the Vulnerable Software and Affected Versions WP Photo Album Plus plugin for WordPress versions prior to 9.0.11.006 Description The WP Photo Album Plus plugin for WordPress is susceptible to Cross-Site Scripting due to inadequate input sanitization and output escaping within the wppa user...
CVE-2025-61681
KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exploited for stored XSS. The upload endpoint only validates file types based on Content-Type headers, lacks file content analysis and...
CVE-2025-61681 Kuno is Vulnerable to Stored XSS Attack via SVG File Upload
KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exploited for stored XSS. The upload endpoint only validates file types based on Content-Type headers, lacks file content analysis and...
EUVD-2025-32427
KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exploited for stored XSS. The upload endpoint only validates file types based on Content-Type headers, lacks file content analysis and...
EUVD-2022-32893
Malicious code in bioql PyPI...
EUVD-2025-15805
Malicious code in bioql PyPI...
EUVD-2025-7054
Malicious code in bioql PyPI...
EUVD-2024-50161
Malicious code in bioql PyPI...
EUVD-2025-26632
Malicious code in bioql PyPI...
EUVD-2022-27845
Malicious code in bioql PyPI...
EUVD-2024-49580
Malicious code in bioql PyPI...