https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:54:20 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-04273 bdu:2024-04273 https://cve.radiocsirt.org/vuln/bdu:2024-04273 https://cve.radiocsirt.org/vuln/bit-ghost-2024-23724 <p><strong>Affected:</strong> Bitnami: ghost</p> <p>Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that &#34;The vendor does not view this as a valid vector.&#34;</p> <p><strong>Affected:</strong> Bitnami: ghost</p> <p>Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that &#34;The vendor does not view this as a valid vector.&#34;</p> https://cve.radiocsirt.org/vuln/bit-ghost-2024-23724 https://cve.radiocsirt.org/vuln/euvd-2026-200004 EUVD-2026-200004 https://cve.radiocsirt.org/vuln/euvd-2026-200004 https://cve.radiocsirt.org/vuln/fkie_cve-2024-23724 <p>Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that &#34;The vendor does not view this as a valid vector.&#34;</p> <p>Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that &#34;The vendor does not view this as a valid vector.&#34;</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-23724 https://cve.radiocsirt.org/vuln/ghsa-99vc-xw8j-phjm <p><strong>Affected:</strong> npm: ghost</p> <p>Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that &#34;The vendor does not view this as a valid vector.&#34;</p> <p><strong>Affected:</strong> npm: ghost</p> <p>Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that &#34;The vendor does not view this as a valid vector.&#34;</p> https://cve.radiocsirt.org/vuln/ghsa-99vc-xw8j-phjm https://cve.radiocsirt.org/vuln/gsd-2024-23724 gsd-2024-23724 https://cve.radiocsirt.org/vuln/gsd-2024-23724