VYPR
← All advisories
Medium severity4.8NVD Advisory· Published Dec 16, 2024· Updated Jun 17, 2026

CVE-2024-55451

CVE-2024-55451

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises from insufficient sanitization of embedded attributes in uploaded SVG files. When a maliciously crafted SVG file is viewed by other backend users, it allows authenticated attackers to execute arbitrary JavaScript in the context of other backend users' browsers, potentially leading to the theft of sensitive tokens.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Ujcms/Ujcms3 versions
    cpe:2.3:a:ujcms:ujcms:9.6.3:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:ujcms:ujcms:9.6.3:*:*:*:*:*:*:*
    • (no CPE)
    • (no CPE)range: =9.6.3
  • Dromara/ujcmsllm-fuzzy
    Range: =9.6.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.