: GWTUpload XSS in the file upload functionality

Advisory ID Internal CORE-2020-0003 1. Advisory Information Title : GWTUpload XSS in the file upload functionality Advisory ID : CORE-2020-0003 Date published : 2020-03-04 Date of last update : 2020-03-04 Vendors contacted : Manuel Carrasco Moñino https://github.com/manolo/gwtupload Release mode ...

CVE-2020-9447

There is an XSS cross-site scripting vulnerability in GwtUpload 1.0.3 in the file upload functionality. Someone can upload a file with a malicious filename, which contains JavaScript code, which would result in XSS. Cross-site scripting enables attackers to steal data, change the appearance of a...

CVE-2020-9447

GWTUpload 1.0.3 is affected by an XSS in the file-upload filename; an attacker can upload a file with a malicious filename to trigger script execution. The issue stems from insufficient sanitization during upload, enabling data theft or UI manipulation. CoreLabs advisory notes patches to sanitize...