method-crm (0.1.0) potentially affected by CVE-2021-37504 via jquery-file-upload (4.0.11)

jquery-file-upload NPM version 4.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on jquery-file-upload and may be impacted: - method-crm 0.1.0 Source cves: CVE-2021-37504 Source advisory: OSV:GHSA-43X9-7HFV-MXRF...

CVE-2021-37504

A cross-site scripting XSS vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name...

CVE-2021-37504

A cross-site scripting XSS vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name...

CVE-2021-37504

CVE-2021-37504 concerns an XSS in the fileNameStr parameter of the jQuery-Upload-File library (v4.0.11). Multiple connected sources corroborate that a crafted file name containing a Javascript payload can cause arbitrary web script execution. The root cause is the unsanitized fileNameStr input; e...