Description
Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.
References (2)
Core 2
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a
Exploit, Patch, Third Party Advisory x_refsource_confirm
https://huntr.dev/bounties/781b5c2a-bc98-41a0-a276-ea12399e5a25
Scores
CVSS v3
9.0
EPSS
0.0033
EPSS Percentile
56.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Details
CWE
CWE-434
Status
published
Products (1)
organizr/organizr
< 2.1.1810
Published
Apr 13, 2022
Tracked Since
Feb 18, 2026