14968 matches found
CVE-2024-5945: Improper Neutralization of Input During Web Page Generation
The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissio...
CVE-2024-34452
CMSimpleXH 1.7.6 allows XSS by uploading a crafted SVG document...
CVE-2024-34452
The PHP-based content management system CMSimple_XH version 1.7.6 is vulnerable to Cross-Site Scripting (XSS) . The root cause is the application's failure to properly validate and sanitize user-uploaded SVG files , which can contain malicious JavaScript code. An authorized user can exploit this ...
PT-2024-37259
Name of the Vulnerable Software and Affected Versions: WP SVG Images plugin for WordPress versions up to, and including, 4.2 Description: The issue is related to Stored Cross-Site Scripting via the type parameter due to insufficient input sanitization. This allows authenticated attackers with...
CVE-2024-34452
CMSimpleXH 1.7.6 allows XSS by uploading a crafted SVG document...
PT-2024-5242 · Roundup · Roundup
Name of the Vulnerable Software and Affected Versions: Roundup versions prior to 2.4.0 Description: The issue is related to the lack of protection of the web page structure in the Roundup error tracking system. This allows a remote attacker to conduct cross-site scripting attacks by uploading...
CVE-2024-34452: Improper Neutralization of Input During Web Page Generation
CMSimpleXH 1.7.6 allows XSS by uploading a crafted SVG document...
CVE-2024-34452
CMSimpleXH 1.7.6 allows XSS by uploading a crafted SVG document...
CVE-2024-28147: Unrestricted Upload of File with Dangerous Type
An authenticated user can upload arbitrary files in the upload function for collection preview images. An attacker may upload an HTML file that includes malicious JavaScript code which will be executed if a user visits the direct URL of the collection preview image Stored Cross Site Scripting. It...
WordPress WP SVG images Plugin <= 4.2 is vulnerable to Cross Site Scripting (XSS)
Software WP SVG images Type Plugin Vulnerable versions = 4.2 Fixed in 4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5945 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8b632fc271b3 Credits Colin Xu Required privilege...
ROS-20240618-01
A vulnerability in the SVG Handler component of the RoundCube email client is related to cross-site scripting attacks. Exploitation of the vulnerability could allow an attacker acting remotely to exploit XSS via the SVG animation attributes. Vulnerability in the User Preferences Handler component...
CVE-2024-4271
The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks...
CVE-2024-4270
CVE-2024-4270 — SVGMagic WordPress plugin (<= 1.1) The vulnerability stems from the plugin not sanitizing SVG file contents, enabling an attacker with at least the author role to upload SVGs containing malicious JavaScript that can trigger Stored XSS. The issue is rooted in insufficient input ...
CVE-2024-4271 SVGator <= 1.2.6 - Stored XSS via SVG Upload
The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks...
CVE-2024-4271 SVGator <= 1.2.6 - Stored XSS via SVG Upload
The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks...
CVE-2024-4270 SVGMagic <= 1.1 - Stored XSS via SVG Upload
The SVGMagic WordPress plugin through 1.1 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks...
CVE-2024-4271: Improper Neutralization of Input During Web Page Generation
The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks...
PT-2024-30112
Name of the Vulnerable Software and Affected Versions SVGator WordPress plugin versions 1.2.6 and earlier Description The issue allows users with at least the author role to upload SVG files containing malicious JavaScript, enabling Stored XSS attacks due to the lack of sanitization of SVG file...
PT-2024-30111
Name of the Vulnerable Software and Affected Versions SVGMagic WordPress plugin versions 1.1 and earlier Description The issue allows users with at least the author role to upload SVG files containing malicious JavaScript, leading to Stored XSS attacks. This is due to the plugin not sanitizing SV...
WordPress plugin SVGator security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...