https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 01:53:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-216031 EUVD-2026-216031 https://cve.radiocsirt.org/vuln/euvd-2026-216031 https://cve.radiocsirt.org/vuln/fkie_cve-2022-32114 <p>An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library &#34;Create (upload)&#34; permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.</p> <p>An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library &#34;Create (upload)&#34; permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-32114 https://cve.radiocsirt.org/vuln/ghsa-4vm8-j95f-j6v5 <p><strong>Affected:</strong> npm: @strapi/strapi</p> <p>An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After an authenticated attacker uploads a file containing a malicious URL, a victim copies and pastes the malicious URL into a new tab to receive the XSS payload.</p> <p><strong>Affected:</strong> npm: @strapi/strapi</p> <p>An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After an authenticated attacker uploads a file containing a malicious URL, a victim copies and pastes the malicious URL into a new tab to receive the XSS payload.</p> https://cve.radiocsirt.org/vuln/ghsa-4vm8-j95f-j6v5 https://cve.radiocsirt.org/vuln/gsd-2022-32114 gsd-2022-32114 https://cve.radiocsirt.org/vuln/gsd-2022-32114