Cross-site Scripting in pekeupload

Description

This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code will be executed.

Recommendation

No fix is available yet. Followings are affected versions:

<= 2.1.1

References

GHSA-89q5-mj78-pw5w
snyk.io
CVE-2021-23673
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Cross-site Scripting in pekeupload and gives you actionable findings to investigate.

Start a free scan

Related Issues

Cross-site Scripting in sanitize-url - CVE-2021-23648
Cross site scripting in datatables.net - CVE-2021-23445
Docsify vulnerable to cross-site scripting due to mishandled encoding - CVE-2021-30074
Cross-site Scripting in bootstrap-table - bootstrap-table - CVE-2021-23472

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated February 01, 2023