Squidex cross-site scripting vulnerability (CNVD-2023-9750454)

squidex is a Headless CMS and content management center. A cross-site scripting vulnerability exists in Squidex versions prior to 7.9.0, which stems from the presence of an incomplete blacklist in the SVG check, and can be exploited by an attacker to conduct a cross-site scripting attack via the...

CVE-2023-50465

A stored cross-site scripting XSS vulnerability exists in Monica aka MonicaHQ 4.0.0 via an SVG document uploaded by an authenticated user...

CVE-2023-50465

A stored cross-site scripting XSS vulnerability exists in Monica aka MonicaHQ 4.0.0 via an SVG document uploaded by an authenticated user...

PT-2023-31568 · Monica · Monica

Name of the Vulnerable Software and Affected Versions: Monica aka MonicaHQ version 4.0.0 Description: A stored cross-site scripting XSS vulnerability exists in the software via an SVG document uploaded by an authenticated user. Recommendations: For version 4.0.0, consider restricting the upload o...

CVE-2023-46857

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

CVE-2023-46857

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

Design/Logic Flaw

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

CVE-2023-46857

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

CVE-2023-46857

Squidex Headless CMS is affected: versions before 7.9.0 suffer an XSS via an SVG document in the Upload Assets feature due to an incomplete blacklist in the SVG inspection. The attack requires the attacker to have assets.create permission and is possible through the SRC attribute of an IFRAME in ...

CVE-2023-46857

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

CVE-2023-4460

The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2023-4460

The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

Design/Logic Flaw

The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2023-4460 Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG

The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2023-4460

CVE-2023-4460 affects the WordPress plugin “Uploading SVG, WEBP and ICO files” up to version 1.2.1. The root cause is lack of sanitisation of uploaded SVG files, enabling stored cross-site scripting (XSS) when a user with as little as Author privileges uploads an SVG containing malicious payloads...

CVE-2023-4460 Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG

The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

PT-2023-29272 · WordPress · Uploading Svg

Name of the Vulnerable Software and Affected Versions: Uploading SVG, WEBP and ICO files WordPress plugin versions 1.2.1 and earlier Description: The issue concerns the failure to sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containin...

PT-2023-30728 · Unknown · Sunlight Cms

Name of the Vulnerable Software and Affected Versions: Sunlight CMS version 8.0.1 Description: A Cross-Site Scripting XSS issue allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the File Manager component. Recommendations: For Sunlight CMS version 8.0.1,...

Exploit for Cross-site Scripting in Helpsystems Cobalt_Strike

Gui-poc-test A testing tool for CobaltStrike-RCE:CVE-2022-3919...

Updated roundcubemail packages fix XSS security vulnerabilities

Updated roundcubemail package fixes security vulnerabilities: Fix cross-site scripting XSS vulnerability in setting Content-Type/ Content-Disposition for attachment preview/download CVE-2023-47272 Fix cross-site scripting XSS vulnerability in handling of SVG in HTML messages. CVE-2023-5631 Some...