CVE-2018-1000062

2018-02-0923:29:02

Google

osv.dev

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.4%

JSON

WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction(), ‘svg’ => ‘image/svg+xml’ that can result in An attacker can execute arbitrary script on an unsuspecting user’s browser. This attack appear to be exploitable via Crafted SVG File.

CPENameOperatorVersion
wondercmseq1.2.0-beta
wondercmseq2.2.0
wondercmseq2.3.0
wondercmseq2.0.1
wondercmseq2.0.2
wondercmseq2.3.1
wondercmseq2.4.0
wondercmseq2.0.0
wondercmseq2.0.6
wondercmseq2.0.5

Name	Operator	Version
wondercms	eq	1.2.0-beta
wondercms	eq	2.2.0
wondercms	eq	2.3.0
wondercms	eq	2.0.1
wondercms	eq	2.0.2
wondercms	eq	2.3.1
wondercms	eq	2.4.0
wondercms	eq	2.0.0
wondercms	eq	2.0.6
wondercms	eq	2.0.5