Bizerba GT-SoftControl security vulnerabilities

Bizerba GT-SoftControl is an HMI software from Bizerba. A security vulnerability exists in Bizerba GT-SoftControl that stems from insufficient validation of the file selection process could result in unauthorized file uploads and overwrites...

WordPress plugin Ayyash Studio The kick-start kit Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in PHP. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Ayyash Studio The kick-start kit 1.0.3 an...

CVE-2025-2576: Improper Neutralization of Input During Web Page Generation

The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

PYSEC-2025-114

A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file...

CVE-2024-55028

A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file...

Denial Of Service (DoS)

Gradio is vulnerable to a Denial of Service DoS. The vulnerability is due to improper file handling due to the dataframe component using pd.readcsv, which accepts compressed files, allowing an attacker to upload a zip bomb that crashes the server...

CVE-2025-2542

The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

CVE-2025-2542

CVE-2025-2542: Your Simple SVG Support (WordPress) is vulnerable to stored XSS via SVG uploads in all versions up to 1.0.1. Exploitation requires authenticated access with Author+ privileges; attacker can inject scripts in pages that render the SVG. Root cause: insufficient input sanitization and...

WordPress Your Simple SVG Support plugin <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Avraham Shemesh in WordPress Plugin Your Simple SVG Support versions = 1.0.1...

PT-2025-12788

Name of the Vulnerable Software and Affected Versions Your Simple SVG Support plugin for WordPress versions up to, and including, 1.0.1 Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

WordPress plugin “Your Simple SVG Support” has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress plugin Your...

CVE-2025-2542: Improper Neutralization of Input During Web Page Generation

The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

Directory Traversal

Overview Kentico.Xperience.Libraries is a package for libraries and applications that use Kentico Xperience API. Affected versions of this package are vulnerable to Directory Traversal via the Staging Sync Server, which does not sufficiently protect librarySubFolderPath against traversal sequence...

CVE-2025-2577

The Bitspecter Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and abov...

PT-2025-12670

Name of the Vulnerable Software and Affected Versions Kentico Xperience versions prior to 13.0.178 Description The Kentico Xperience application does not fully validate or filter files uploaded through the multiple-file upload functionality. This insufficient validation allows for stored Cross-Si...

PHPGurukul eLearning System Code Issues and Vulnerabilities

PHPGurukul eLearning System is an eLearning system from PHPGurukul Inc. A code issue vulnerability exists in version 1.0 of the PHPGurukul eLearning System, which stems from an image processing component in the file /user/index.php that could lead to unlimited uploads...

Yue Lao Blind Box Code Issues and Vulnerabilities

Yue Lao Blind Box 月老瞎盒 is a take-off program by imsue individual developers. A code issue vulnerability exists in Yue Lao Blind Box version 4.0 and prior versions, which stems from an incorrect manipulation of the parameter data that can lead to unlimited uploads...

CVE-2024-12871

An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or...

CVE-2024-9107

A stored cross-site scripting XSS vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, affecting version git 20b2e02. The vulnerability arises from improper sanitization of HTML tags in chat history uploads. Specifically, the sanitization logic fails to handle HTML tags within code...

CVE-2024-8029

An XSS vulnerability was discovered in the upload files process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks...