CVE-2019-9845

2019-04-1617:53:22

mitre

www.cve.org

AI Score

9.8

Confidence

High

EPSS

0.006

Percentile

79.0%

JSON

madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in Controllers/BlogController.cs writes a decoded base64 string to a file without validating the extension.