EUVD-2022-3803

Malicious code in bioql PyPI...

Cross-Site Scripting (XSS)

fof/upload is vulnerable to cross-site scripting. The vulnerability exists in FoF Upload because the uploaded SVG files are not properly validated which allows an attacker to inject and execute arbitrary javascript...

Possible cross-site scripting attack via unsanitized SVG files in FoF Upload

Impact If FoF Upload is configured to allow the uploading of SVG files image/svg+xml, navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service...

GHSA-FM53-MPMP-7QW2 Possible cross-site scripting attack via unsanitized SVG files in FoF Upload

Impact If FoF Upload is configured to allow the uploading of SVG files image/svg+xml, navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service...

CVE-2022-30999 Possible cross-site scripting attack via unsanitized SVG files in FoF Upload

FriendsofFlarum FoF Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files 'image/svg+xml', navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an...

CVE-2022-30999

FriendsofFlarum FoF Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files 'image/svg+xml', navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an...

CVE-2022-30999

The CVE-2022-30999 issue affects the FoF Upload extension for Flarum, where SVG uploads (image/svg+xml) in versions before 1.2.3 allow direct SVG file access to execute arbitrary JavaScript decided by an attacker. This could enable data leakage or malicious modification by an authenticated Flarum...

CVE-2022-30999 Possible cross-site scripting attack via unsanitized SVG files in FoF Upload

FriendsofFlarum FoF Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files 'image/svg+xml', navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an...

PT-2022-20445

Name of the Vulnerable Software and Affected Versions FoF Upload versions prior to 1.2.3 Description The issue allows arbitrary Javascript code execution when navigating directly to an SVG file URI, potentially leading to data leakage or malicious modification by an authenticated Flarum user. Thi...

CVE-2022-30999: Improper Neutralization of Input During Web Page Generation

FriendsofFlarum FoF Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files 'image/svg+xml', navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an...