Description

Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT element.

Remediation

References

CVE-2018-19146

Related Vulnerabilities

Coppermine Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-7186)

WordPress Plugin MP3-jPlayer Multiple Cross-Site Request Forgery Vulnerabilities (2.7.3)

phpMyAdmin Improper Input Validation Vulnerability (CVE-2016-9858)

Jenkins Cleartext Storage of Sensitive Information Vulnerability (CVE-2025-67637)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-5833)

Severity

Medium

Classification

CVE-2018-19146 CWE-707 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities