Skip to content
OpenAdvisories

Package · Packagist

webreinvent/vaahcms

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.1
    CVE-2025-61183 Public exploit

    VaahCMS is vulnerable to XSS through its Avatar Upload endpoint

    Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php

    webreinvent/vaahcms Packagist