CVE-2023-7089

CVE-2023-7089 – Easy SVG Allow (WordPress)

CVE-2023-7089 Easy SVG Allow <= 1.0 - Author+ Stored XSS via SVG

The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2023-7089: Improper Neutralization of Input During Web Page Generation

The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

WordPress Allow SVG Plugin < 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Allow SVG Type Plugin Vulnerable versions 1.2.0 Fixed in 1.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6541 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e1ff41df5c9e Credits Bob Matyas Required privilege...

PT-2024-15208

Name of the Vulnerable Software and Affected Versions Easy SVG Allow WordPress plugin version 1.0 Description The issue arises from the plugin's failure to sanitize uploaded SVG files, potentially allowing users with a role as low as Author to upload malicious SVG files containing XSS payloads...

CVE-2023-48202

Cross-Site Scripting XSS vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the File Manager component...

Cross site scripting

Cross-Site Scripting XSS vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the File Manager component...

CVE-2023-48202: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the File Manager component...

Allow SVG < 1.2.0 - Author+ Stored XSS via SVG

Description The plugin does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. Upload an SVG with the following code: alert"xss"; Access the uploaded file directly to see the XSS...

Allow SVG < 1.2.0 - Author+ Stored XSS via SVG

Description The plugin does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. PoC Upload an SVG with the following code: Access the uploaded file directly to see the XSS...

CVE-2023-48202

Cross-Site Scripting XSS vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the File Manager component...

CVE-2023-48202

CVE-2023-48202 affects Sunlight CMS 8.0.1. An authenticated low-privileged user can escalate privileges via a crafted SVG file in the File Manager component, exploiting an XSS flaw. The vulnerability is documented across multiple feeds (NVD, Red Hat, OSV, CNNVD, etc.). Remediation guidance observ...

CVE-2023-48202

Cross-Site Scripting XSS vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the File Manager component...

CVE-2023-48202

Cross-Site Scripting XSS vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the File Manager component...

CVE-2024-22550

An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file...

Privilege escalation

An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file...

CVE-2024-22550: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file...

CVE-2024-22550

An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file...

CVE-2024-22550

An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file...

ShopSite Security Breach

ShopSite is an online store from ShopSite Inc. A security vulnerability exists in ShopSite v14.0, which stems from an arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi that allows an attacker to execute arbitrary code by uploading a specially crafted SVG file...