Threats tagged 'ghsa-2wm3-c93q-vv9p'

Paicoding versions 1.0.0 through 1.0.3 contain a stored cross-site scripting (XSS) vulnerability in the image upload functionality. The vulnerability arises because the ImageServiceImpl.validateStaticImg method accepts SVG files, which can include embedded scripts. When these SVG images are uploaded by authenticated attackers and served from the site origin using local storage, the scripts execute in the context of users viewing the images. This can lead to theft of non-HttpOnly f-session cookies and account hijacking.