Cross-site Scripting in Zenario CMS
Moderate severity
GitHub Reviewed
Published
Mar 15, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Description
Published by the National Vulnerability Database
Mar 14, 2022
Published to the GitHub Advisory Database
Mar 15, 2022
Reviewed
Mar 28, 2022
Last updated
Jan 27, 2023
Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.
References