passera

Hinweis: Ich habe nicht mehr die Zeit, die Entwicklung von Passera fortzusetzen, aber Pull Requests sind mehr als willkommen! Der am häufigsten angefragte Punkt wäre eine aktualisierte Firefox-Erweiterung, da die letzte API-Änderung die aktuelle Version kaputt gemacht hat. Passera Ein einfaches...

GHSA-GFJP-2P8F-94QV Ghost: Stored XSS via File Uploads on Local Storage

Impact Ghost restricts the content type that uploaded files are served with, to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file...

NPM: Ghost: Stored XSS via File Uploads on Local Storage

NPM: Ghost: Stored XSS via File Uploads on Local Storage vulnerability discovered by ? in WordPress Npm ghost versions = 6.22.1, 6.64.0...

EUVD-2026-92770

Ghost: Stored XSS via File Uploads on Local Storage...

Ghost: Stored XSS via File Uploads on Local Storage

Impact Ghost restricts the content type that uploaded files are served with, to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file...

CVE-2026-105679

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679

The Ghost Node.js content management system is vulnerable to Stored XSS in versions 6.22.1 through 6.64.0 . The root cause is that the restriction on content types for uploaded files is not applied when using the default local storage adapter , allowing files to be served with content types deriv...

CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

PT-2026-106198

Name of the Vulnerable Software and Affected Versions Ghost versions 6.22.1 through 6.63.0 Description Ghost is a Node.js content management system. When using the default local storage adapter, the system fails to restrict the content type of uploaded files. This allows files uploaded by staff...

CVE-2026-104411

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to...

EUVD-2026-91422

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to...

CVE-2026-104411

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to...

CVE-2026-104411

Ghost versions 6.22.1 before 6.64.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists because the default local storage adapter allows staff users to upload files served with extension-derived content types , enabling them to host malicious scripts. An attacker ...

CVE-2026-104411 Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to...

CVE-2026-104411 Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to...

CVE-2026-104411 Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to...