871 matches found
Cross-site Scripting (XSS) - Stored in idempiere/idempiere
✍️ Description Stored xss via svg file upload 🕵️♂️ Proof of Concept you can upload this svg file https://github.com/ranjit-git/poc/blob/master/evilsvgfile.svg .\ Check this 1 minute video to reproduce the bug https://drive.google.com/file/d/1nKXfSUjU5vDEMMY6cAmRs6d3MCPoj0uv/view?usp=sharing 💥...
Cross-Site Scripting (XSS)
getkirby/cms is vulnerable to cross-site scripting. An attacker with write access to the Kirby Panel may upload an SVG file that contains malicious...
CouchCMS 2.2.1 - Persistent Cross-Site Scripting
Exploit Title: CouchCMS 2.2.1 - XSS via SVG file upload Date: 2021-01-25 Exploit Author: xxcdd Vendor Homepage: https://github.com/CouchCMS/CouchCMS Software Link: https://github.com/CouchCMS/CouchCMS Version: v2.2.1 Tested on: Windows 7 An issue was discovered in CouchCMS v2.2.1...
Squaredup Cross-Site Scripting Vulnerability
Squaredup is a web service from Squaredup UK that provides data monitoring capabilities for cloud environments. A cross-site scripting vulnerability exists in SquaredUp versions prior to 4.6.0, which can be exploited by a user to create a dashboard, execute malicious content in an iframe, or uplo...
CVE-2020-9390
SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
XWiki 跨站脚本漏洞
Xwiki is a Wiki platform for creating Web collaboration applications from the French company Xwiki. XWiki version 12.10.2 contains a cross-site scripting vulnerability that could be exploited to launch a cross-site scripting attack against a target via the SVG document upload comment feature...
Xwiki CMS 12.10.2 Cross Site Scripting
Exploit Title: Xwiki CMS 12.10.2 - Cross Site Scripting XSS Date: 17-01-2021 Exploit Author: Karan Keswani Vendor Homepage: https://www.xwiki.org/xwiki/bin/view/Main/WebHome Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: Xwiki CMS- 12.10.2 Tested on: Windows 10 Description...
CVE-2020-8281
A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting XSS attacks...
CVE-2020-8280
A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting XSS attacks...
CVE-2020-8281
A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting XSS attacks...
PT-2021-11951
Name of the Vulnerable Software and Affected Versions: Elementor Website Builder plugin versions prior to 3.0.14 Description: The issue concerns the Elementor Website Builder plugin for WordPress, which does not properly restrict SVG uploads. This could potentially lead to security issues, althou...
Elementor < 3.0.14 - SVG Upload Allowed by Default
The plugin allowed SVG files to be uploaded by default, which might lead to security issues, such as Cross-Site Scripting...
CVE-2020-36171: Improper Neutralization of Input During Web Page Generation
The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads...
PT-2021-12718
Name of the Vulnerable Software and Affected Versions: Nextcloud Contacts version 3.3.0 Description: A missing file type check in Nextcloud Contacts allows a malicious user to upload malicious SVG files to perform cross-site scripting XSS attacks. Recommendations: For Nextcloud Contacts version...
Nextcloud 跨站脚本漏洞
Nextcloud Contacts is the user interface for Nextcloud's CardDAV server. A cross-site scripting vulnerability exists in Nextcloud Contacts 3.4.0. The vulnerability stems from a missing file type check. The vulnerability can be exploited to conduct cross-site scripting attacks by uploading SVG fil...