GHSA-hv6m-qj65-26q3

UnoPim Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-50637

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	unopim/unopim	< 0.1.4	0.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-50637 advisory
https://github.com/unopim/unopim/issues/41 web
https://github.com/unopim/unopim package
https://github.com/unopim/unopim/releases/tag/v0.1.4 web
https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md web