patrickdeanramos/WonderCMS-version-3.4.3-SVG-Stored-Cross-Site-Scripting

patrickdeanramos/WonderCMS-version-3.4.3-SVG-Stored-Cross-Site-Scripting

GitHubGitHub
GitHubgithub.com
Releases0
WonderCMS version 3.4.3 is vulnerable to stored cross-site scripting (XSS) during file uploads involving SVG files.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2024-41304↗
5.4 MEDIUM—

An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file.