Threats Tagged 'ghsa-mgqc-836v-2pjm'

A vulnerability in Webkul Aureus ERP versions up to 1.6.0 allows authenticated users to upload malicious SVG files containing JavaScript. These files are stored on a public disk and served from the application origin, enabling script execution when the SVG file URL is accessed. This can lead to session cookie theft and CSRF token exfiltration. The issue is fixed in a commit identified as 53ad76d.