Cross site scripting

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks...

CVE-2021-24960 WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks...

PT-2022-9530

Name of the Vulnerable Software and Affected Versions WordPress File Upload WordPress plugin versions prior to 4.16.3 wordpress-file-upload-pro WordPress plugin versions prior to 4.16.3 Description The issue allows users with a role as low as Contributor to configure the upload form to allow...

CVE-2021-24960: Unrestricted Upload of File with Dangerous Type

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks...

WordPress plugin code-related vulnerabilities

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. WordPress plugin is an application plugin for WordPress. Cross-site scripting vulnerability exists in versions of WordPress File Upload plugin prior to 4.16.3, which stems from the plugin allowing users...

PeTeReport Cross-Site Scripting Vulnerability

PeTeReport is an open source application vulnerability reporting tool. PeTeReport has a cross-site scripting vulnerability that stems from the software's lack of filtering and escaping of user data, which could be exploited by an attacker to inject persistent JavaScript code through an...

CVE-2022-23051

PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the 'svgfile' parameter...

Code injection

PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the 'svgfile' parameter...

PT-2022-15811

Name of the Vulnerable Software and Affected Versions PeteReport version 0.5 Description The issue allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the svg file parameter. This enables the execution of malicious code, potentially...

VulnCheck KEV: CVE-2013-1675

Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site...

GHSA-W6CX-QG2Q-RVQ8 Path Traversal in @finastra/ssr-pages

A path traversal issue can occur when providing untrusted input to the svg property as an argument to the buildMessagePageOptions function. References - https://github.com/Finastra/ssr-pages/pull/1 - https://github.com/Finastra/ssr-pages/pull/1/commits/c3e4c563384ae3ba3892f37dd190218577620780...

CVE-2022-24718

ssr-pages is an HTML page builder for the purpose of server-side rendering SSR. In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the "svg" property as an argument to the "buildMessagePageOptions" function. While there is no known workaround at this...

Cross-site Scripting (XSS) - Stored

Description SVG sanitizer cloud be bypassed via flowing SVG file that leads to stored XSS Proof of Concept Upload the above SVG file in your profile, view it, and click anywhere on the page then XSS will be triggered : Impact This vulnerability is capable of performing arbitrary actions on behalf...

Ssr Pages Builder: Path traversal vulnerability

Ssr Pages is an Html page builder for Ssr server-side rendering. a path traversal vulnerability exists in Ssr Pages, which stems from a path traversal issue that can occur when untrusted input is provided to the svg attribute as an argument to the buildMessagePageOptions function, which can be...

CVE-2022-24718: Improper Limitation of a Pathname to a Restricted Directory

ssr-pages is an HTML page builder for the purpose of server-side rendering SSR. In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the svg property as an argument to the buildMessagePageOptions function. While there is no known workaround at this time,...

PT-2022-16826

Name of the Vulnerable Software and Affected Versions ssr-pages versions prior to 0.1.4 Description ssr-pages is an HTML page builder for the purpose of server-side rendering SSR. A path traversal issue can occur when providing untrusted input to the svg property as an argument to the...

WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin <= 0.9.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin versions = 0.9.5. Solution Update the WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin to the latest available version at least 0.9.6...

WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin <= 0.9.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin versions = 0.9.5. Solution Update the WordPress SVG Flags – Beautiful Scalable Flags For All Countries! plugin to the latest available...

FreeBSD : typo3 -- XSS vulnerability in svg-sanitize (0eab001a-9708-11ec-96c9-589cfc0f81b0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0eab001a-9708-11ec-96c9-589cfc0f81b0 advisory. - svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all...

TYPO3 SVG Sanitizer Vulnerability (TYPO3-PSA-2022-001)

TYPO3 is prone to a sanitization bypass vulnerability in SVG Sanitizer. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...