CVE-2023-26771

Taskcafe 0.3.2 is vulnerable to Cross-Site Scripting (XSS) via an SVG profile picture upload due to a lack of validation in the filetype. An authenticated attacker can upload a malicious SVG, with the payload executed when a victim opens the file. Affected component: upload handling for SVG profi...

CVE-2023-26770

CVE-2023-26770 affects TaskCafe 0.3.2 and is caused by lack of validation in the Cookie value. An unauthenticated attacker who knows a registered UserID can change that user’s password. Public sources (NVD/Red Hat/OSV) describe the issue identically. The Red Hat/NVD entries note no public details...