CVE-2021-4302

A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to...

CVE-2021-4302

A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to...

CVE-2021-4302 slackero phpwcms SVG File cross site scripting

A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to...

CVE-2021-4302

A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to...

CVE-2023-22461

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal -tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on sanitize-sv...

Cross site scripting

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal -tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on sanitize-sv...

CVE-2023-22461 sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal -tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on sanitize-sv...

CVE-2023-22461 sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal -tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on sanitize-sv...

CVE-2023-22461

CVE-2023-22461 concerns the sanitizer package sanitize-svg . The issue arises from a deny-list approach that fails to block certain vectors, allowing embedded JavaScript via literal [removed] tags or on-* attributes in SVGs. The vulnerability affects versions prior to 0.4.0; a patch was released ...

CVE-2023-22461 sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal -tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on sanitize-sv...

CVE-2023-22461

The "sanitize-svg" package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal ""-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on...

CVE-2023-22461: Improper Neutralization of Input During Web Page Generation

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal...

phpwcms cross-site scripting vulnerabilities

phpwcms is an open source web content management system. It is fast, easy to install and runs on any standard web server platform that supports PHP/MySQL. A cross-site scripting vulnerability exists in versions prior to phpwcms 1.9.26, which stems from an unknown portion of the component SVG file...

PT-2023-12406 · Slackero · Phpcms

Name of the Vulnerable Software and Affected Versions: slackero phpwcms versions up to 1.9.26 Description: A vulnerability was found in the SVG File Handler component of slackero phpwcms, which can be exploited to lead to cross site scripting. The manipulation can be initiated remotely...

Sanitize-svg security vulnerability

sanitize-svg is a small SVG sanitizer to prevent XSS attacks. A security vulnerability exists in versions of sanitize-svg prior to 0.4.0 that stems from its use of deny-list mode to sanitize svg to prevent cross-site scripting, but an attacker can cause downstream software that relies on it to...

CVE-2021-4302: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to...

Cross-site Scripting (XSS)

github.com/usememos/memos is vulnerable to stored cross-site scripting attacks. When a user uploads a file with .svg extension with direct access, the server response with content-type: image/svg+xml leading to processing SVG as HTML, allowing an attacker to inject malicious javascript...

svg-sketch-pdf (>=1.0.12, <=1.0.28) potentially affected by CVE-2018-25061 via rgb2hex (0.1.0)

rgb2hex NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on rgb2hex and may be impacted: - svg-sketch-pdf =1.0.12, =1.0.28 Source cves: CVE-2018-25061 Source advisory: GHSA-7599-FQGM-V84P...

svg-sketch-pdf (>=1.0.12, <=1.0.28) potentially affected by CVE-2018-25061 via rgb2hex (0.1.0)

rgb2hex NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on rgb2hex and may be impacted: - svg-sketch-pdf =1.0.12, =1.0.28 Source cves: CVE-2018-25061 Source advisory: OSV:GHSA-7599-FQGM-V84P...

svg-sketch-pdf (>=1.0.12, <=1.0.28) potentially affected by CVE-2018-25061 via rgb2hex (0.1.0)

rgb2hex NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on rgb2hex and may be impacted: - svg-sketch-pdf =1.0.12, =1.0.28 Source cves: CVE-2018-25061 Source advisory: MEND:CVE-2018-25061...