EUVD-2024-32820

Malicious code in bioql PyPI...

WordPress SVGMagic Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software SVGMagic Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4270 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 09ac0fcf4d2c Credits Rayhan Ramdhany Hanaputra Required...

SVGMagic <= 1.1 - Stored XSS via SVG Upload

Description The plugin does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks. PoC 1. Create a SVG file with the malicious payload within it; Example SVG file:...