CVE-2022-23065

In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users...

Cross site scripting

In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users...

CVE-2022-23065 Vendure - XSS via SVG File Upload

In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users...

CVE-2022-23065

CVE-2022-23065 affects Vendure versions 0.1.0-alpha.2 to 1.5.1, with a Stored XSS vulnerability that allows an attacker with catalog permission to upload an SVG containing JavaScript in the Assets tab. The uploaded file can affect administrators and regular users. The root cause is described as i...

CVE-2022-23065 Vendure - XSS via SVG File Upload

In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users...

CVE-2022-23065

In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users...

EUVD-2010-1431

WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, accesses uninitialized memory during the handling of a use element in an SVG document, which allows remote attackers to execute arbitrary code or cause a denial of service application cra...

WordPress Tripetto plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Tripetto plugin 5.1.4 and previous versions contain a cross-site scripting vulnerability th...

Adobe Photoshop SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SVG...

Multiple Store XSS via upload svg file and the file name of attachment

Description Hi There, facturascripts is vulnerable to store XSS by upload svg file, and the filename Step to produce with svg file Login as admin or any account has role Admin-Library, access Admin - library - New and upload file svg with content: alertdocument.cookie; save this. XSS will be...

CVE-2021-36895

Unauthenticated Cross-Site Scripting XSS vulnerability in Tripetto's Tripetto plugin = 5.1.4 on WordPress via SVG image upload...

CVE-2021-36895

Unauthenticated Cross-Site Scripting XSS vulnerability in Tripetto's Tripetto plugin = 5.1.4 on WordPress via SVG image upload...

Cross site scripting

Unauthenticated Cross-Site Scripting XSS vulnerability in Tripetto's Tripetto plugin = 5.1.4 on WordPress via SVG image upload...

CVE-2021-36895

CVE-2021-36895: Unauthenticated XSS in WordPress Tripetto plugin versions <= 5.1.4 via SVG image upload. Root cause per CNVD/CNNVD entries is lack of filtering/escaping for uploaded SVG data. Affected: Tripetto WordPress plugin

CVE-2021-36895 WordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image upload

Unauthenticated Cross-Site Scripting XSS vulnerability in Tripetto's Tripetto plugin = 5.1.4 on WordPress via SVG image upload...

CVE-2021-36895 WordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image upload

Unauthenticated Cross-Site Scripting XSS vulnerability in Tripetto's Tripetto plugin = 5.1.4 on WordPress via SVG image upload...

WordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image upload

Unauthenticated Cross-Site Scripting XSS vulnerability via SVG image upload discovered by Ngo Van Thien Patchstack Alliance in WordPress Tripetto plugin versions = 5.1.4. Solution Update the WordPress Tripetto plugin to the latest available version at least 5.2.0...

Tripetto < 5.2.0 - Unauthenticated Stored Cross-Site Scripting

The plugin does not validate uploaded attachment files, which could allow unauthenticated users to upload malicious SVG and lead to Cross-Site Scripting...

WordPress plugin Tripetto 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Tripetto plugin 5.1.4 and previous versions contain a cross-site scripting vulnerability th...

Cross-site Scripting (XSS)

xml2rfc is vulnerable to cross-site scripting. The vulnerability exists in the validate function in base.py due to lack of input validation which allows an attacker to inject and craft svg images embedded with malicious scripts...