Threats tagged 'ghsa-49mg-4v6p-32w2'

Vvveb versions prior to 1.0.8.1 have a stored cross-site scripting (XSS) vulnerability that allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript. This is achieved by bypassing MIME type validation through prepending a GIF89a header to malicious payloads, renaming files to .html, and executing scripts in administrator sessions. The vulnerability can lead to backdoor account creation and uploading malicious plugins for remote code execution.