11158 matches found
CVE-2022-1562
The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
CVE-2022-1562
The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
Design/Logic Flaw
The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
WordPress plugin Enable SVG 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Enable SVG plugin version 1.4.0 or earlier has a cross-site scripting vulnerability that...
WordPress Allow svg files plugin <= 1.0 - Authenticated Arbitrary File Upload vulnerability
Authenticated Arbitrary File Upload vulnerability discovered by Luan Pedersini in WordPress Allow svg files plugin versions = 1.0. Solution Update the WordPress Allow svg files plugin to the latest available version at least 1.1...
Cross-Site Scripting (XSS)
fof/upload is vulnerable to cross-site scripting. The vulnerability exists in FoF Upload because the uploaded SVG files are not properly validated which allows an attacker to inject and execute arbitrary javascript...
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
Impact If FoF Upload is configured to allow the uploading of SVG files image/svg+xml, navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service...
GHSA-FM53-MPMP-7QW2 Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
Impact If FoF Upload is configured to allow the uploading of SVG files image/svg+xml, navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service...
CVE-2022-30999
The CVE-2022-30999 issue affects the FoF Upload extension for Flarum, where SVG uploads (image/svg+xml) in versions before 1.2.3 allow direct SVG file access to execute arbitrary JavaScript decided by an attacker. This could enable data leakage or malicious modification by an authenticated Flarum...
CVE-2022-30999 Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
FriendsofFlarum FoF Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files 'image/svg+xml', navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an...
CVE-2022-30999 Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
FriendsofFlarum FoF Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files 'image/svg+xml', navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an...
GHSA-W358-RJ93-R5QV Apache Superset Stored XSS on Dashboard markdown
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...
GHSA-FF28-F46G-R9G8 Cross-site Scripting in Gogs
Impact The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations allow uploading SVG text/xml files as issue attachments non-default are affected. Patches Correctly setting the Content Security Policy for the serving endpoint. Users should...
Cross-site Scripting in Gogs
Impact The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations allow uploading SVG text/xml files as issue attachments non-default are affected. Patches Correctly setting the Content Security Policy for the serving endpoint. Users should...
silverstripe-advancedreports vulnerable to XSS
silverstripe-advancedreports aka the Advanced Reports module for SilverStripe 1.0 through 2.0 is vulnerable to Cross-Site Scripting XSS because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item ak...
GHSA-FXF3-WX3C-76PF Shopware vulnerable to Cross-site Scripting
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication...
Shopware vulnerable to Cross-site Scripting
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication...
GHSA-RRWX-8WM4-QHH4 GleamTech FileUltimate Cross-site Scripting
The FileExplorer component in GleamTech FileUltimate 6.1.5 allows XSS via an SVG document...