CVE-2021-37504
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a JavaScript payload in the file name.
Risk Assessment
The risk for the organization includes arbitrary script execution in the victim's browser, potentially leading to session theft, account takeover, or data leakage.
Recommendation
It is recommended to immediately update the jQuery-Upload-File library to the latest version and implement server-side validation and sanitization of file names.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.