Subodh Kumar

**Name of the Vulnerable Software and Affected Versions** Rhymix CMS version 1.9.8.1 **Description** The issue allows for XSS via an SVG upload in the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint, specifically through the upload of malicious SVG files. **Recommendations** For Rhymix CMS version 1.9.8.1, consider disabling the SVG upload functionality in the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Rhymix CMS version 1.9.8.1 **Description** The issue allows for Server-Side Request Forgery (SSRF) via an SVG upload in the admin module. This can be achieved by accessing the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint with a malicious SVG file. **Recommendations** For Rhymix CMS version 1.9.8.1, as a temporary workaround, consider disabling the SVG upload feature in the admin module until a patch is available. Restrict access to the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Backdrop CMS versions prior to 1.11.1 **Description** The issue is related to a Cross Site Scripting (XSS) vulnerability in the sanitization of custom class names used on blocks and layouts, which can result in the execution of JavaScript from an unexpected source. This can be exploited when a user is directed to an affected page while logged in. **Recommendations** For Backdrop CMS versions prior to 1.11.1, update to version 1.11.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Pixelimity version 1.0 **Description** The issue is related to Persistent XSS, which can be exploited via the `data[title]` parameter in the "admin/portfolio.php" endpoint. This is demonstrated by a crafted `onload` attribute of an SVG element. **Recommendations** For Pixelimity version 1.0, consider restricting access to the `admin/portfolio.php` endpoint until a fix is available, and avoid using the `data[title]` parameter in this endpoint to minimize the risk of exploitation.