Joomla! Cross-site scripting vulnerability (CNVD-2022-64101)

A cross-site scripting vulnerability exists in Joomla! versions 4.0.0 to 4.1.0, which stems from the handling of SVG images without sufficient cleanup and escaping of user-supplied data, and could be exploited to upload malicious SVG images on vulnerable websites and execute arbitrary HTML and...

Joomla! 2.5.x < 3.10.7 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.10.7 or 4.x prior to 4.1.1. It is, therefore, affected by multiple vulnerabilities. - Extracting an specifilcy crafted tar package could write files outside of the intended path...

CVE-2022-23801

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in commedia...

CVE-2022-23801

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in commedia...

Design/Logic Flaw

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in commedia...

CVE-2022-23801

Joomla! 4.0.0–4.1.0 is affected by a cross-site scripting (XSS) vulnerability via an SVG embedding path in com_media. Root cause: improper handling/cleanup of SVG content leading to executable HTML/script in the user’s browser. Public references describe a possible XSS attack vector through SVGs,...

GHSA-P2J7-6G9H-32XH Cross site scripting in Shopizer

A Stored Cross Site Scripting XSS vulnerability exists in Shopizer versions v2.0.2 through v2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code...

Cross site scripting in Shopizer

A Stored Cross Site Scripting XSS vulnerability exists in Shopizer versions v2.0.2 through v2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code...

PT-2022-16273 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 4.0.0 through 4.1.0 Description: An issue was discovered in Joomla, allowing a possible XSS attack vector through SVG embedding in com media. Recommendations: For Joomla! versions 4.0.0 through 4.1.0, consider disabling the S...

CVE-2022-23059

A Stored Cross Site Scripting XSS vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code...

Cross site scripting

A Stored Cross Site Scripting XSS vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code...

CVE-2022-23059

Shopizer CVE-2022-23059 is a Stored XSS in versions 2.0–2.17.0 exploitable via the Manage Images tab, where an SVG upload containing malicious JavaScript could be executed in the victim’s context. The connected advisories (GHSA and OSV entries) corroborate the same vulnerable range and vector. Th...

CVE-2022-23059 Shopizer - Stored XSS in Manage Images

A Stored Cross Site Scripting XSS vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code...

CVE-2022-23059 Shopizer - Stored XSS in Manage Images

A Stored Cross Site Scripting XSS vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code...

Joomla! 跨站脚本漏洞

A cross-site scripting vulnerability exists in Joomla! versions 4.0.0 to 4.1.0, which stems from the handling of SVG images without sufficient cleanup and escaping of user-supplied data, and could be exploited to upload malicious SVG images on vulnerable websites and execute arbitrary HTML and...

CVE-2022-0595

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dndcodedropzupload AJAX action, which could lead to Stored Cross-Site Scripting issue...

CVE-2022-0595

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dndcodedropzupload AJAX action, which could lead to Stored Cross-Site Scripting issue...

CVE-2022-0595

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dndcodedropzupload AJAX action, which could lead to Stored Cross-Site Scripting issue...

Cross site scripting

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dndcodedropzupload AJAX action, which could lead to Stored Cross-Site Scripting issue...

EUVD-2022-15702

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dndcodedropzupload AJAX action, which could lead to Stored Cross-Site Scripting issue...