CVE-2018-1000062

2022-10-0316:21:59

mitre

www.cve.org

wondercms 2.4.0

stored cross-site scripting

file upload

svg vulnerability

crafted svg file

arbitrary script

browser security

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.4%

JSON

WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction(), ‘svg’ => ‘image/svg+xml’ that can result in An attacker can execute arbitrary script on an unsuspecting user’s browser. This attack appear to be exploitable via Crafted SVG File.