Avatar Uploader Project maintains a specialized file-upload utility whose vulnerability profile reflects the security challenges inherent to handling user-supplied files and web input: the recurring exposures cluster around path traversal conditions that can permit unauthorized file access and cross-site scripting flaws in file-display or metadata-handling logic. Treat this as a compact, focused vendor profile; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Avatar Uploader Project over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-50957MEDIUM Drupal avatar_uploader 7.x-1.0-beta8 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the f | May 10, 2026 | 6.1 | 27 | NO | NO |
CVE-2015-2087MEDIUM Unrestricted file upload vulnerability in the Avatar Uploader module before 6.x-1.3 for Drupal allows remote authenticated users to execute arbitrary PHP code by uploading a file w | Feb 26, 2015 | 6.5 | 18 | NO | NO |
CVE-2014-9155MEDIUM Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows remote authenticated users to read arbitra | Dec 1, 2014 | 4.0 | 14 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Avatar Uploader Project.
Media articles that mention a CVE ID that affects a product developed by Avatar Uploader Project — matched by CVE ID, not by vendor name.