Mautic 安全漏洞

Mautic is an open source marketing automation software from Mautic Open Source. The software monitors and manages websites, sends emails and manages customer resources. A security vulnerability exists in Mautic that stems from an unrestricted uploaded file type that could lead to remote code...

CVE-2025-65844

EverShop 2.0.1 is affected. An unauthenticated remote attacker can upload arbitrary files and create directories via /api/images due to insufficient server-side validation. This could lead to impersonation of login panels and disk-space exhaustion (DoS). Remediation guidance in connected sources ...

CVE-2025-65844

EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary...

WordPress plugin SureMail 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...

CVE-2025-66403

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting XSS vulnerability exists in the Filerise application due to improper handling of uploaded SVG files. The application accepts user-supplied SVG...

CVE-2025-66403 FileRise Vulnerable to Stored XSS via SVG Upload

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting XSS vulnerability exists in the Filerise application due to improper handling of uploaded SVG files. The application accepts user-supplied SVG...

EUVD-2025-200090

Todoist v8896 is vulnerable to Cross Site Scripting XSS in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment...

CVE-2025-63317

Todoist v8896 is vulnerable to Cross Site Scripting XSS in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment...

CVE-2025-63317

Todoist v8896 is vulnerable to Cross Site Scripting XSS in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment...

CVE-2025-59890

Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is...

Cross-site Scripting (XSS)

bagisto/bagisto is vulnerable to stored cross-site scripting XSS.The vulnerability is due to the application's failure to sanitize malicious payloads in uploaded SVG files, which allows an authenticated admin attacker to embed JavaScript that executes in the victim’s browser...

PT-2025-48574

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 2.2.3 Description FileRise is a self-hosted web-based file manager. A stored cross-site scripting XSS issue exists due to improper handling of uploaded SVG files. The application accepts user-supplied SVG uploads...

Todoist 安全漏洞

Todoist is a task management and to-do list application from Todoist, Inc. A security vulnerability exists in Todoist version v8896, which stems from a lack of cleanup of uploaded SVG files in /api/v1/uploads, which could lead to a cross-site scripting attack...

CVE-2025-63317

Todoist v8896 is vulnerable to Cross Site Scripting XSS in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment...

CVE-2025-63317

Todoist v8896 is affected by an XSS vulnerability in the /api/v1/uploads endpoint. Uploaded SVG files are not sanitized, allowing embedded JavaScript to execute when a user opens the attachment from a task or comment. The Red Hat and EU/NVD entries corroborate Todoist v8896 as vulnerable to SVG-b...

Mogu blog 代码问题漏洞

Mogu blog 蘑菇博客 is a micro-architecture based front-end and back-end shared blog system by individual developers in Streamlet, China. A code issue vulnerability exists in Mogu blog v2 5.2 and earlier versions, which stems from an unrestricted parameter filedatas in file/file/pictures, which could...

CVE-2025-65112

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain...

CVE-2025-65112

PubNet is a self-hosted Dart/Flutter package service. CVE-2025-65112 concerns the /api/storage/upload endpoint, which prior to version 1.1.3 allowed unauthenticated users to upload packages using arbitrary author-id values, enabling identity spoofing and privilege escalation. Public advisories fr...

EUVD-2025-199884

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain...

CVE-2025-65112 PubNet Critical Authentication Bypass Allows Unauthenticated Package Upload and Identity Spoofing

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain...