11172 matches found
Design/Logic Flaw
Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-19601
Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-19600
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-19601
Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-19600
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-19600
Rhymix CMS 1.9.8.1 is affected by a Cross‑Site Scripting (XSS) vulnerability in the index.php?module=admin&act=dispModuleAdminFileBox page, exploitable by uploading a specially crafted SVG file. The root cause is the handling of SVG uploads that allows injected scripts/HTML to execute in the cont...
CVE-2018-19601
CVE-2018-19601 : Rhymix CMS 1.9.8.1 is affected by an SSRF via an SVG upload in index.php?module=admin&act=dispModuleAdminFileBox. The entry documents an SSRF risk but provides no public details on affected files beyond the described vector. CVSS metrics indicate high/severe impact (CVSS3 base sc...
CVE-2018-19600
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
Fedora 28 : rubygem-loofah (2018-d716df9942)
XXS when a crafted SVG element is republished CVE-2018-16468. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...
CuppaCMS Cross-Site Scripting Vulnerability (CNVD-2019-00811)
CuppaCMS is a content management system CMS. A cross-site scripting vulnerability exists in CuppaCMS. A remote attacker can exploit this vulnerability by uploading a specially crafted SVG document to the administrator//component/tablemanager/view/cuviews URI to execute JavaScript script...
Cross site scripting
CuppaCMS has XSS via an SVG document uploaded to the administrator//component/tablemanager/view/cuviews URI...
CVE-2018-19918
CuppaCMS has XSS via an SVG document uploaded to the administrator//component/tablemanager/view/cuviews URI...
CVE-2018-19918
CuppaCMS has XSS via an SVG document uploaded to the administrator//component/tablemanager/view/cuviews URI...
CVE-2018-19918
CVE-2018-19918 — CuppaCMS XSS via SVG upload : The vulnerability affects CuppaCMS, where uploading a crafted SVG to the administrator/#/component/table_manager/view/cu_views URI enables cross-site scripting. The issue is categorized with a CVSS v3.1 base score of 5.4 (MEDIUM): network attack vect...
CVE-2018-19918
CuppaCMS has XSS via an SVG document uploaded to the administrator//component/tablemanager/view/cuviews URI...
Cross-site Scripting (XSS)
getkirby/kirby is vulnerable to cross-site scripting XSS. The vulnerability is possible due to incorrect file validation via "site files" Add option while uploading an SVG file...
PT-2018-15163 · Cuppacms · Cuppacms
Name of the Vulnerable Software and Affected Versions: CuppaCMS affected versions not specified Description: The issue is related to a Cross-Site Scripting XSS attack. It occurs when an SVG document is uploaded to the administrator//component/table manager/view/cu views URI, allowing malicious...
Cross site scripting
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file...