Threats tagged 'ghsa-ffwr-vmf2-gpp2'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
High	8.7	CVE-2026-129427Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO in Cervantes version High8.72026-11-14GCVE DatabaseCVE-2026-129427 Cervantes version v1.3-beta contains a stored cross-site scripting (XSS) vulnerability via avatar upload combined with an authentication bypass in the /Attachments endpoint. This flaw could allow an attacker to execute arbitrary code in another user's browser with elevated privileges, potentially leading to account takeover (ATO). The vulnerability has a high severity rating with a CVSS score of 8.7. Report on CVE-2026-129427 Vulnerability CWE-79 #ghsa-ffwr-vmf2-gpp2	GCVE Database	2026-11-14

Page 1 of 1