Persistent XSS in Pixelimity by Pixelimity Team
CVE-2018-19919

4.8MEDIUM

Key Information:

Vendor

Pixelimity

Status
Pixelimity
Vendor
CVE Published:
6 December 2018

What is CVE-2018-19919?

Pixelimity version 1.0 is susceptible to a persistent cross-site scripting vulnerability that enables an attacker to inject malicious scripts through the data[title] parameter in the admin/portfolio.php file. An attacker can exploit this flaw by crafting an SVG element's onload attribute, which would execute arbitrary JavaScript code when the page is accessed. This issue highlights the importance of validating and sanitizing input to prevent unauthorized script execution and protect user data.

References

https://github.com/pixelimity/pixelimity/issues/19
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.