CVE-2024-4759

MEDIUM Year: 2024
CVSS v3 Score
5.5
Medium
Weakness Type
CWE-79
View all →

Vulnerability Description

The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

Related Vulnerabilities

CVE-2016-4790

MEDIUM
CVSS:5.5(Medium)

Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote ...

CWE-792016

CVE-2016-5265

MEDIUM
CVSS:5.5(Medium)

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by...

CWE-792016

CVE-2018-0719

MEDIUM
CVSS:5.5(Medium)

Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on bu...

CWE-792018

CVE-2018-20244

MEDIUM
CVSS:5.5(Medium)

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

CWE-792018

CVE-2018-6681

MEDIUM
CVSS:5.5(Medium)

Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in th...

CWE-792018

CVE-2019-12667

MEDIUM
CVSS:5.5(Medium)

A vulnerability in the web framework code of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interfa...

CWE-792019