Gauravnarwani97

An issue allows a user to store an IFRAME element, containing a `user/card.php` CSRF request, in their Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF, which checks the Referer header, is bypassed because the attack originates from one of the application's own settings pages.

The issue allows for stored XSS execution on the Preference page and when sending an email. This occurs when a malicious payload is inserted inside the Email Signature in the Preference page. An attacker can insert malicious JavaScript inside their email signature, which is executed when the victim replies or forwards the mail, potentially allowing the attacker to steal victims' cookies and compromise their accounts.

An issue allows stored XSS execution when an attacker sends an attachment with malicious JavaScript in the filename to an admin. This JavaScript is executed when the admin selects the particular file from the list of all attachments, potentially allowing the attacker to steal victims' cookies and compromise their accounts.

An issue allows stored XSS in the body of an Article, which is executed when a victim opens articles received through mail. The Article can be formed by an attacker using the Knowledge Base feature. The attacker could inject malicious JavaScript inside the body of the article to steal victims' cookies, thus compromising their accounts.

The issue allows a malicious user to inject JavaScript in the title and breadcrumb of a newly formed entity, which can lead to stored XSS execution. This can result in the theft of user cookies when someone visits a publicly accessible link.

The issue allows for stored XSS execution when a victim clicks on the Edit Dashboard feature on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which fires when a user clicks on the Edit Dashboard button, allowing the attacker to steal victims' cookies and compromise their accounts.