CVE-2021-23673

Cross-site Scripting (XSS)

CVSS 5.4 MEDIUMEPSS 0.8%

This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code will be executed.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P

Produtos afetados

n/a · pekeupload

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/moxiecode/plupload/blob/120cc0b5dd3373d7181fd11b06ac2557c890d3f0/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226 https://snyk.io/vuln/SNYK-JS-PEKEUPLOAD-1584360