Description
XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php.
Remediation
References
Related Vulnerabilities
Jboss Deserialization of Untrusted Data Vulnerability (CVE-2017-7504)
e107 Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2022-50916)
WordPress Plugin Database Backup for WordPress 'edit.php' Directory Traversal (1.7)
Drupal Core 4.7.x Arbitrary Code Execution (4.7.0)
WordPress Plugin Viper's Video Quicktags Unspecified Vulnerability (6.4.4)