PT-2023-32743 · WordPress · Svg Support

Name of the Vulnerable Software and Affected Versions: SVG Support plugin for WordPress versions up to, and including, 2.5.5 Description: The issue is related to Stored Cross-Site Scripting via the SVG upload feature due to insufficient input sanitization and output escaping. This allows...

CVE-2023-50251: Uncontrolled Recursion

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a use tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the...

php-svg-lib security vulnerability

php-svg-lib is an open source SVG file parsing/rendering library from dompdf. A security vulnerability exists in php-svg-lib versions prior to 0.5.1. The vulnerability stems from the fact that when processing a use tag that references an image tag, the attributes in the use tag are merged into th...

php-svg-lib security vulnerability

php-svg-lib is an open source SVG file parsing/rendering library from dompdf. A security vulnerability exists in versions of php-svg-lib prior to 0.5.1, which stems from the fact that parsing attributes passed to the use tag within an svg document may cause the system to enter infinite recursion,...

CVE-2023-49279: Improper Neutralization of Input During Web Page Generation

Umbraco is an ASP.NET content management system CMS. Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a...

PT-2023-31510 · Unknown +1 · Php-Svg-Lib +1

Name of the Vulnerable Software and Affected Versions: php-svg-lib versions prior to 0.5.1 Description: The issue arises when handling tags that reference tags, as it merges attributes from the tag to the tag. This is particularly problematic when the href attribute from the tag has not been...

Exploits

CVE-2024-44872: Authenticated Cross Site Scripting XSS Attac...

CVE-2023-50465

A stored cross-site scripting XSS vulnerability exists in Monica aka MonicaHQ 4.0.0 via an SVG document uploaded by an authenticated user...

Cross site scripting

A stored cross-site scripting XSS vulnerability exists in Monica aka MonicaHQ 4.0.0 via an SVG document uploaded by an authenticated user...

CVE-2023-50465: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in Monica aka MonicaHQ 4.0.0 via an SVG document uploaded by an authenticated user...

CVE-2023-50465

The CVE-2023-50465 issue affects Monica (MonicaHQ) 4.0.0, where an authenticated user can upload an SVG document that triggers stored cross-site scripting (XSS). Documented by multiple sources (NVD/Red Hat/OSV/CVE lists) with a CVSS v3.1 base score of 5.4 (Medium) and privileges required: Low, us...

Squidex cross-site scripting vulnerability (CNVD-2023-9750454)

squidex is a Headless CMS and content management center. A cross-site scripting vulnerability exists in Squidex versions prior to 7.9.0, which stems from the presence of an incomplete blacklist in the SVG check, and can be exploited by an attacker to conduct a cross-site scripting attack via the...

CVE-2023-50465

A stored cross-site scripting XSS vulnerability exists in Monica aka MonicaHQ 4.0.0 via an SVG document uploaded by an authenticated user...

CVE-2023-50465

A stored cross-site scripting XSS vulnerability exists in Monica aka MonicaHQ 4.0.0 via an SVG document uploaded by an authenticated user...

PT-2023-31568 · Monica · Monica

Name of the Vulnerable Software and Affected Versions: Monica aka MonicaHQ version 4.0.0 Description: A stored cross-site scripting XSS vulnerability exists in the software via an SVG document uploaded by an authenticated user. Recommendations: For version 4.0.0, consider restricting the upload o...

CVE-2023-46857

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

CVE-2023-46857

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

Design/Logic Flaw

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

CVE-2023-46857: Improper Neutralization of Input During Web Page Generation

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

CVE-2023-46857

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...