CVE-2021-25975 — Publify - Stored Cross-Site Scripting (XSS) due to Unrestricted File Upload

Description (CNA)

In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file.

Affected (CNA)

Vendor / product	Versions
publify_core / publify_core	affected v8.0 before unspecified; affected unspecified through v9.2.4

CWE

CWE-79

References

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25974
https://github.com/publify/publify/commit/d99c0870d3dbbfde7febdc6cad33199b84770101

ADP enrichment

CVE

No English description supplied.

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25974
https://github.com/publify/publify/commit/d99c0870d3dbbfde7febdc6cad33199b84770101

CISA-ADP

No English description supplied.

No references supplied.