https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T03:32:19.204728+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-254429 EUVD-2026-254429 2026-10-08T03:32:19.208097+00:00 EUVD-2026-254429 https://cve.radiocsirt.org/vuln/fkie_cve-2025-61183 fkie_cve-2025-61183 2026-10-08T03:32:19.208133+00:00

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php

 https://cve.radiocsirt.org/vuln/ghsa-q769-phqg-263r GHSA-q769-phqg-263r — VaahCMS is vulnerable to XSS through its Avatar Upload endpoint 2026-10-08T03:32:19.208165+00:00

Affected: Packagist: webreinvent/vaahcms

Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php