https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 21:40:47 +0000 https://cve.radiocsirt.org/vuln/cve-2018-8811 <p>Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. Note: It is argued that OpenCMS allows only registered users to upload different kind of content artifacts (SVG, .doc, .docx). The uploaded content is stored in the CMS content repository &#34;as is&#34;. In case of scripts inside an SVG, this may or may not be &#34;malicious&#34;, there is no way of knowing if the uploaded SVG contains the script for a reason. To exploit the &#34;issue&#34;, a user must have an account in the CMS as a content manager</p> <p>Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. Note: It is argued that OpenCMS allows only registered users to upload different kind of content artifacts (SVG, .doc, .docx). The uploaded content is stored in the CMS content repository &#34;as is&#34;. In case of scripts inside an SVG, this may or may not be &#34;malicious&#34;, there is no way of knowing if the uploaded SVG contains the script for a reason. To exploit the &#34;issue&#34;, a user must have an account in the CMS as a content manager</p> https://cve.radiocsirt.org/vuln/cve-2018-8811