| शीर्षक | toeverything AFFiNE 0.24.1 Cross Site Scripting |
|---|
| विवरण | A critical Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Avatar Upload Image endpoint. The vulnerability allows an attacker to upload a malicious SVG file containing obfuscated JavaScript code. This file is permanently stored on the server and automatically executed in the browser of any user who views the image. Using the cookie sandwich technique, an attacker can steal the cookies of affected users and redirect them to an arbitrary endpoint.
|
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/1L6gX0GY8cE9rS6o50oJzuMRPVMerFQNS |
|---|
| उपयोगकर्ता | HAMZAOUI Mohamed (UID 91388) |
|---|
| सबमिशन | 07/10/2025 09:48 PM (1 वर्ष पहले) |
|---|
| संयम | 19/10/2025 04:59 AM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 329025 [toeverything AFFiNE तक 0.24.1 Avatar Upload Image Endpoint क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|