Lucene search
Veracode Vulnerability DatabaseVERACODE:33066HistoryNov 23, 2021 - 3:58 a.m.
Cross-site Scripting (XSS)
2021-11-2303:58:17
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
0.001 Low
EPSS
Percentile
38.8%
plupload is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the file.name field as it does not properly encode the user input file name.
References
github.com/moxiecode/plupload/blob/120cc0b5dd3373d7181fd11b06ac2557c890d3f0/js/jquery.plupload.queue/jquery.plupload.queue.js#L226
github.com/moxiecode/plupload/blob/120cc0b5dd3373d7181fd11b06ac2557c890d3f0/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226
github.com/moxiecode/plupload/commit/0d00239327c3e4e5b76478c94ec7332ce1e7ddc5
Related
cnvd
cnvd
pekeUpload cross-site scripting vulnerability
2021-11-04 00:00:00
prion
prion
Design/Logic Flaw
2021-11-22 17:15:00
cve
cve
CVE-2021-23673
2021-11-22 17:15:08
osv
osv
Cross-site Scripting in pekeupload
2021-12-02 17:52:26
cvelist
cvelist
CVE-2021-23673 Cross-site Scripting (XSS)
2021-11-22 00:00:00
github
github
Cross-site Scripting in pekeupload
2021-12-02 17:52:26
nvd
nvd
CVE-2021-23673
2021-11-22 17:15:08