Subodh Kumar

A autenticação inadequada no ASP.NET Core permite que um invasor não autorizado eleve privilégios através de uma rede. Este problema afeta especificamente as páginas de Identity geradas pelo scaffolder ou templates, como 'ForgotPassword' e 'ResetPassword'.

The issue allows for XSS via an SVG upload in the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint, specifically through the upload of malicious SVG files.

The issue allows for Server-Side Request Forgery (SSRF) via an SVG upload in the admin module. This can be achieved by accessing the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint with a malicious SVG file.

The issue is related to a Cross Site Scripting (XSS) vulnerability in the sanitization of custom class names used on blocks and layouts, which can result in the execution of JavaScript from an unexpected source. This can be exploited when a user is directed to an affected page while logged in.

The issue is related to Persistent XSS, which can be exploited via the `data[title]` parameter in the "admin/portfolio.php" endpoint. This is demonstrated by a crafted `onload` attribute of an SVG element.