Threats affecting pkg:github/jianyan74/rageframe2

4 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	4.7	EPSS 0.5%	CVE-2024-30883rageframe2 · Reflected Cross Site Scripting (XSS) Medium4.7EPSS 0.5%2024-04-11CVE Database V5CVE-2024-30883 Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the aspectRatio parameter in the image cropping function. EPSS 0.5%Vulnerability CWE-79	CVE Database V5	2024-04-11
Medium	5.4	EPSS 0.4%	CVE-2024-30880rageframe2 · Reflected Cross Site Scripting (XSS) Medium5.4EPSS 0.4%2024-04-11CVE Database V5CVE-2024-30880 Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the multiple parameter in the image cropping function. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-04-11
Medium	6.1	EPSS 0.4%	CVE-2024-30879rageframe2 · Reflected Cross Site Scripting (XSS) Medium6.1EPSS 0.4%2024-04-11CVE Database V5CVE-2024-30879 Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the boxId parameter in the image cropping function. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-04-11
Medium	6.1	EPSS 0.4%	CVE-2024-30878rageframe2 · A Cross-site Scripting (XSS) Medium6.1EPSS 0.4%2024-04-11CVE Database V5CVE-2024-30878 A cross-site scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the upload_drive parameter. EPSS 0.4%Vulnerability CWE-94	CVE Database V5	2024-04-11

Page 1 of 1