Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2021-23260

Stored XSS Vulnerability in File Name of the File Upload function

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
crafter

Description

Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Crafter Software Crafter CMS

  • 3.1 to < 3.1.12affected

References