| शीर्षक | Open-Source Samarium - Business Management System 0.9.6 Arbitrary JavaScript Execution via Unsanitized SVG Upload |
|---|
| विवरण | A Cross-Site Scripting (XSS) vulnerability has been identified in Samarium - Business Management System, version v0.9.6. The application allows SVG files to be uploaded through the image upload feature in /cms/webpage/ without proper validation or sanitization.
An attacker can exploit this flaw by uploading a malicious .svg file containing embedded JavaScript code. When the file is accessed directly from the /gallery directory and rendered by the browser, the malicious code is executed in the context of the victim's session. The attack can even be exploited against unauthenticated users if the link to the malicious file is shared. |
|---|
| स्रोत | ⚠️ https://github.com/MaiqueSilva/VulnDB/blob/main/README09.md |
|---|
| उपयोगकर्ता | maique (UID 88562) |
|---|
| सबमिशन | 13/08/2025 08:55 PM (1 वर्ष पहले) |
|---|
| संयम | 25/08/2025 11:12 AM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 321259 [oitcode samarium तक 0.9.6 Pages Image /cms/webpage/ क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|