Executive brief
Cross-site scripting (XSS) in the dynamic file uploads
Affected products
- RubyGems decidim-core
- RubyGems decidim
Junglewise Threat Intelligence
CVE-2023-51447: Cross-site scripting (XSS) in the dynamic file uploads
CVE-2023-51447 · Severity: low · CVSS 3.1 · Published 2024-02-20
Technologies: decidim (RubyGems). Vendors: RubyGems.
Related threats
- Decidim's private data exports can lead to data leaks
- Decidim has a cross-site scripting vulnerability in the version control page
- Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor
- Decidim vulnerable to data disclosure through the embed feature
- Decidim vulnerable to sensitive data disclosure