Lautaro Casanova

The Media module supports oEmbed, which utilizes two discovery mechanisms: `providers.json` and URL discovery. The URL discovery code can be exploited to trick the system into making unauthorized server-side requests to any arbitrary URL. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker can force a server to send requests to an unintended location.

The issue allows an unauthenticated attacker to view all stored server files of all users.

The issue allows an attacker to change the avatar of their profile, enabling the upload of files with HTML extension that can interpret both HTML and JavaScript.

The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "settings" endpoint and `first name` parameter.

The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "people:id/work" endpoint, specifically using the `job` and `company` parameters.

The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "people:id/relationships" endpoint, specifically using the `first name` and `last name` parameters.

The issue allows an authenticated remote attacker to execute malicious code in the application. This is achieved via CSTI in the "people/add" endpoint, utilizing parameters such as `nickName`, `description`, `lastName`, `middleName`, and `firstName`.

The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "people:id/food" endpoint and `food` parameter.

The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "people:id/introductions" endpoint and `first met additional info` parameter.