Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1odjZtLXFqNjUtMjZxM84ABBCA

UnoPim Cross-site Scripting vulnerability

UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.

The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.

Permalink: https://github.com/advisories/GHSA-hv6m-qj65-26q3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1odjZtLXFqNjUtMjZxM84ABBCA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 month ago
Updated: about 1 month ago


CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Percentage: 0.00045
EPSS Percentile: 0.16725

Identifiers: GHSA-hv6m-qj65-26q3, CVE-2024-50637
References: Repository: https://github.com/unopim/unopim
Blast Radius: 1.0

Affected Packages

packagist:unopim/unopim
Dependent packages: 0
Dependent repositories: 0
Downloads: 383 total
Affected Version Ranges: < 0.1.4
Fixed in: 0.1.4
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3
All unaffected versions: 0.1.4, 0.1.5, 0.1.6