CVE-2024-13294

The Drupal POST File module (versions before 1.0.2 ) is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. A malicious actor can exploit this flaw to perform XSS attacks remotely. While the module provides an endpoint at /postfile/upload f...

CVE-2024-13293

The Drupal POST File module (versions before 1.0.2 ) is vulnerable to an unauthenticated Cross-Site Request Forgery (CSRF) . The flaw exists because the module fails to provide sufficient protection against cross-site requests when handling file uploads at the /postfile/upload endpoint. A malicio...