| शीर्षक | o2oa ≤ 10.0-410-g3d5e0d2 XSS |
|---|
| विवरण | In o2oa versions up to 10.0-410-g3d5e0d2, the endpoint /x_file_assemble_control/jaxrs/attachment/upload/folder/{folderId} is vulnerable to stored cross-site scripting (XSS). The vulnerability arises because the application does not restrict the file extensions of uploaded files, allowing an attacker to upload malicious files such as .pdf or .html, which can later be accessed and executed in the browser. |
|---|
| स्रोत | ⚠️ https://github.com/o2oa/o2oa/issues/171 |
|---|
| उपयोगकर्ता | meraklbz (UID 87053) |
|---|
| सबमिशन | 18/08/2025 04:45 AM (1 वर्ष पहले) |
|---|
| संयम | 29/08/2025 08:18 AM (11 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 266143 [O2OA 8.3.8 PDF File अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|