Beveiligingsadvies

CVE-2026-41467

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-04-27 15:11:37

Laatst bijgewerkt 2026-07-14 20:00:53

Toegewezen door VulnCheck

CVSS-score 5.4

Status PUBLISHED

Beschrijving

ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName() function fails to restrict HTML and HTM file uploads. Authenticated attackers can upload HTML files containing arbitrary JavaScript through the image upload or attachment endpoints, and any user accessing the uploaded file URL will execute the embedded JavaScript in their browser.

← Alle CVE's bekijken Bekijk op cve.org ↗