Lucene search
Veracode Vulnerability DatabaseVERACODE:38654HistoryDec 27, 2022 - 4:00 a.m.
Cross-site Scripting (XSS)
2022-12-2704:00:26
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
xss
github.com
usememos/memos
newserver function
user-input sanitization
malicious svg file
0.001 Low
EPSS
Percentile
20.3%
github.com/usememos/memos is vulnerable to cross site scripting. The vulnerability exists in the NewServer function of server.go because of a image direct link due to improper user-input sanitization by uploading a malicious svg file.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/usememos/memos | le | v0.8.3 | |
| github.com/usememos/memos | le | v0.8.3 |
Related
huntr
huntr
Stored XSS via SVG File
2022-12-20 08:15:50
osv
osv
usememos/memos vulnerable to stored cross-site scripting (XSS)
2022-12-23 12:30:25
CVE-2022-4690
2022-12-23 12:15:12
cve
cve
CVE-2022-4690
2022-12-23 12:15:12
nvd
nvd
CVE-2022-4690
2022-12-23 12:15:12
cvelist
cvelist
CVE-2022-4690 Cross-site Scripting (XSS) - Stored in usememos/memos
2022-12-23 00:00:00
prion
prion
Cross site scripting
2022-12-23 12:15:00
github
github
usememos/memos vulnerable to stored cross-site scripting (XSS)
2022-12-23 12:30:25