| Titre | zhousg https://github.com/zhousg/letao <=1.0.0 Dangerous type of file upload (CWE-434) |
|---|
| Description | The project uses formidable with keepExtensions set to true, and has insecure file upload checking mechanisms. It allows attackers to upload malicious files with arbitrary extensions, potentially creating attack vectors for stored Cross-Site Scripting (XSS) |
|---|
| La source | ⚠️ https://github.com/zhousg/letao/issues/13 |
|---|
| Utilisateur | ZAST.AI (UID 87884) |
|---|
| Soumission | 21/07/2025 11:43 (il y a 1 Année) |
|---|
| Modérer | 24/07/2025 17:19 (3 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 317513 [zhousg letao routes\bf\product.js pictrdtz élévation de privilèges] |
|---|
| Points | 17 |
|---|