https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 22:11:12 +0000 https://db.gcve.eu/vuln/cve-2026-111168 <p><strong>Affected:</strong> abhinavxd libredesk</p> <p>LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed &#39;image/svg+xml; x&#39; via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent&#39;s or administrator&#39;s session.</p> <p><strong>Affected:</strong> abhinavxd libredesk</p> <p>LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed &#39;image/svg+xml; x&#39; via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent&#39;s or administrator&#39;s session.</p> https://db.gcve.eu/vuln/cve-2026-111168