CVE-2021-30140

LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator

Medium · published April 6, 2021

CVSS v3.1
5.4
EPSS
1%
Percentile
71.5
In the wild
Unconfirmed
What it is

LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content (such as SVG with HTML content), the payload is executed upon a click. This is fixed in 3.5.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R
CVSS v4.0
Not supplied
EPSS
0.01360 · 71.5th percentile
Published
2021-04-06T15:46Z
EPSS history
Timeline
  • 06 APR 15:46Z
    LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator
    cvelistv5