Threat database

Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers.

Ghost versions up to 5.76.0 contain a stored cross-site scripting (XSS) vulnerability that allows a contributor to escalate privileges by uploading an SVG profile picture with embedded JavaScript. This script can interact with the API on localhost TCP port 3001, potentially enabling account takeover. The vendor does not consider this a valid attack vector.

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.