Cross-site Scripting (XSS)

2023-04-0515:37:12

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

kiwitcms

vulnerability

svg upload

javascript

content-security-policy

malicious

EPSS

0.001

Percentile

21.0%

JSON

kiwitcms is vulnerable to stored Cross-site Scripting (XSS). The vulnerability exists because the library does not define the Content-Security-Policy header to block inline JavaScript, which allows an attacker to inject and execute malicious javascript through the malicious SVG file upload.