CVE-2021-30140

LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content such as SVG with HTML content, the payload is executed upon a click. This is fixed in 3.5...

LiquidFiles 3.4.15 Cross Site Scripting Vulnerability

LiquidFiles - 3.4.15 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents================================================== Overview Detailed description Timeline of disclosure Thanks & Acknowledgements References ===== Vulnerability...

CVE-2021-30140

CVE-2021-30140 affects LiquidFiles 3.4.15, which contains a stored cross-site scripting (XSS) vulnerability in the "+send email" feature when sending a file to an administrator. If the attached file has no extension and contains malicious HTML/JavaScript content (e.g., SVG with HTML), the payload...