| शीर्षक | Krayin Krayin CRM ≤ 2.2.5 Cross Site Scripting |
|---|
| विवरण | A stored cross-site scripting (XSS) vulnerability in the TinyMCE media upload functionality of Krayin CRM through 2.2.5 allows an authenticated user with upload permissions to bypass SVG sanitization by uploading SVG content with a non-SVG client filename. The application relies on the client-controlled file extension when deciding whether to sanitize the content, allowing malicious SVG files containing JavaScript to be stored and served from the public storage directory, resulting in arbitrary JavaScript execution in the application origin. |
|---|
| स्रोत | ⚠️ https://github.com/carlosalbertotuma/advisory/blob/main/advisory-03-stored-xss-tinymce-media-upload.md |
|---|
| उपयोगकर्ता | bl4dsc4n (UID 94778) |
|---|
| सबमिशन | 05/08/2026 12:54 AM (2 महीनों पहले) |
|---|
| संयम | 25/09/2026 12:05 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 409909 [Krayin laravel-crm तक 2.2.5 TinyMCE Media Upload Sanitizer.php क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|