GitHub Advisoryadvisory · Packagist

GHSA-hv6m-qj65-26q3 UnoPim Cross-site Scripting vulnerability

MEDIUM Published 2024-11-06 Modified 2024-11-06 Official page ↗
Aliases
CVE-2024-50637
Ecosystem
Packagist
Packages
unopim/unopim
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-11-06

Affected packages

• Packagist unopim/unopim: < 0.1.4 → fixed in 0.1.4

Description

UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.

Related

Alias · CVE (1)

  • CVE-2024-50637 UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References