403 matches found
MantisBT Cross-Site Scripting Vulnerability (CNVD-2022-58240)
MantisBT is the Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in MantisBT versions prior to 2.25.5, which originated from a...
silverstripe-advancedreports vulnerable to XSS
silverstripe-advancedreports aka the Advanced Reports module for SilverStripe 1.0 through 2.0 is vulnerable to Cross-Site Scripting XSS because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item ak...
GleamTech FileUltimate Cross-site Scripting
The FileExplorer component in GleamTech FileUltimate 6.1.5 allows XSS via an SVG document...
librsvg DoS via Cyclic References
librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service infinite loop, stack consumption, and application crash via cyclic references in an SVG document...
GHSA-J984-Q4QC-6QXF librsvg DoS via Cyclic References
librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service infinite loop, stack consumption, and application crash via cyclic references in an SVG document...
XWiki Cross-Site Scripting Vulnerability (CNVD-2022-72198)
Xwiki is a Wiki platform for creating Web collaboration applications from the French company Xwiki. XWiki version 12.10.2 contains a cross-site scripting vulnerability that could be exploited to launch a cross-site scripting attack against a target via the SVG document upload comment feature...
Studio 42 elFinder allows stored XSS
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
CVE-2021-45919
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
CVE-2021-45919
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
CVE-2021-45919: Improper Neutralization of Input During Web Page Generation
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document...
CVE-2021-42051
An issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload permissions can upload a malicious SVG document that contains an XSS payload...
CVE-2021-42051: Improper Neutralization of Input During Web Page Generation
An issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload permissions can upload a malicious SVG document that contains an XSS payload...
GHSA-G6V7-VQHX-6V6C XML External Entity Reference in org.opencms:opencms-core
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
XML External Entity Reference in org.opencms:opencms-core
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
CVE-2021-3312
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
Xxe
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
CVE-2021-3312: Improper Restriction of XML External Entity Reference
An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...
CVE-2021-36787
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document...
