Executive brief
Persistent Cross-site Scripting vulnerability in PrivateBin
Affected products
- Packagist privatebin/privatebin
Junglewise Threat Intelligence
CVE-2022-24833: Persistent Cross-site Scripting vulnerability in PrivateBin
CVE-2022-24833 · Severity: low · CVSS 3.1 · Published 2022-04-12
Technologies: privatebin/privatebin (Packagist). Vendors: Packagist.
Related threats
- PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request
- PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/pr
- PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users
- PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal
- PrivateBin is missing HTML sanitization of attached filename in file size hint