Sonnt0393

**Name of the Vulnerable Software and Affected Versions** grandnode grandnode2 versions prior to 2.4.0 **Description** A path traversal issue exists in the Excel Import component. A remote attacker can exploit this by manipulating the `Picture1`, `Picture2`, or `Picture3` arguments within the `ProductImportDataObject.PrepareProductPictures()` function. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** Upgrade to version 2.4.0.

**Name of the Vulnerable Software and Affected Versions** grandnode grandnode2 versions prior to 2.4.0-beta **Description** A remote cross site scripting issue exists within the Product Description Handler component. The flaw is located in the `Html.Raw()` function within the file `src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml`. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** Update to version 2.4.0-beta or 2.4.0.