Threats tagged 'ghsa-jvgc-4pc6-8x5f'

A stored cross-site scripting (XSS) vulnerability exists in Bludit 4.0.0-beta that allows a low-privileged authenticated user with the Author role to inject arbitrary JavaScript code. This is achieved by uploading a crafted SVG file as the site logo, which contains a stored script tag that executes in the browser of any user who views the logo. The vulnerability has a CVSS score of 5.4, indicating a medium severity level.