Lucene search
GoogleOSV:CVE-2021-32245HistoryJun 16, 2021 - 9:15 p.m.
CVE-2021-32245
2021-06-1621:15:08
Google
osv.dev
3
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to “/storage/exp.svg” that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.
References
Related
cvelist
cvelist
CVE-2021-32245
2021-06-16 20:37:41
cve
cve
CVE-2021-32245
2021-06-16 21:15:08
osv
osv
Cross-site scripting in PageKit
2021-06-22 15:17:28
prion
prion
Design/Logic Flaw
2021-06-16 21:15:00
veracode
veracode
Cross-Site Scripting (XSS)
2021-06-17 06:25:36
github
github
Cross-site scripting in PageKit
2021-06-22 15:17:28
cnvd
cnvd
PageKit Cross-Site Scripting Vulnerability
2021-06-18 00:00:00
nvd
nvd
CVE-2021-32245
2021-06-16 21:15:08