Cross-site Scripting in apostrophe

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed...

Denial of Service (DoS)

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Denial of Service DoS. The media upload feature crashes permanently when a low privileged attacker uploads a crafted...

PT-2021-16895 · Unknown · Camaleon Cms

Name of the Vulnerable Software and Affected Versions: Camaleon CMS versions 2.0.1 through 2.6.0 Description: The media upload feature in Camaleon CMS crashes permanently when an attacker with low privileged access uploads a specially crafted .svg file, resulting in an Uncaught Exception. This...

CVE-2021-37794

A stored cross-site scripting XSS vulnerability exists in FileBrowser v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the...

CVE-2021-24362

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will b...

Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVG

The plugin did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly ie in the...

CVE-2021-24386

The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to...

CVE-2021-32245

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that wil...

CVE-2021-32245

PageKit CMS is affected by CVE-2021-32245. In PageKit v1.0.18, SVG uploads can contain malicious scripts that are not stripped, allowing an attacker to craft a link to /storage/exp.svg that, when clicked, triggers a cross-site scripting (XSS) payload. The vulnerability is corroborated across mult...

Cross-site Scripting (XSS) - Stored in idempiere/idempiere

✍️ Description Stored xss via svg file upload 🕵️‍♂️ Proof of Concept you can upload this svg file https://github.com/ranjit-git/poc/blob/master/evilsvgfile.svg .\ Check this 1 minute video to reproduce the bug https://drive.google.com/file/d/1nKXfSUjU5vDEMMY6cAmRs6d3MCPoj0uv/view?usp=sharing 💥...

Cross-Site Scripting (XSS)

getkirby/cms is vulnerable to cross-site scripting. An attacker with write access to the Kirby Panel may upload an SVG file that contains malicious...

CouchCMS 2.2.1 - Persistent Cross-Site Scripting

Exploit Title: CouchCMS 2.2.1 - XSS via SVG file upload Date: 2021-01-25 Exploit Author: xxcdd Vendor Homepage: https://github.com/CouchCMS/CouchCMS Software Link: https://github.com/CouchCMS/CouchCMS Version: v2.2.1 Tested on: Windows 7 An issue was discovered in CouchCMS v2.2.1...

Squaredup Cross-Site Scripting Vulnerability

Squaredup is a web service from Squaredup UK that provides data monitoring capabilities for cloud environments. A cross-site scripting vulnerability exists in SquaredUp versions prior to 4.6.0, which can be exploited by a user to create a dashboard, execute malicious content in an iframe, or uplo...

CVE-2020-9390

SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script...

CVE-2021-3137

XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...

CVE-2021-3137

XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...

CVE-2021-3137

XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...

CVE-2021-3137

XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...

XWiki 跨站脚本漏洞

Xwiki is a Wiki platform for creating Web collaboration applications from the French company Xwiki. XWiki version 12.10.2 contains a cross-site scripting vulnerability that could be exploited to launch a cross-site scripting attack against a target via the SVG document upload comment feature...

Xwiki CMS 12.10.2 Cross Site Scripting

Exploit Title: Xwiki CMS 12.10.2 - Cross Site Scripting XSS Date: 17-01-2021 Exploit Author: Karan Keswani Vendor Homepage: https://www.xwiki.org/xwiki/bin/view/Main/WebHome Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: Xwiki CMS- 12.10.2 Tested on: Windows 10 Description...