nvd-json-data-feeds/CVE-2023/CVE-2023-481xx/CVE-2023-48114.json

{
  "id": "CVE-2023-48114",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2023-12-21T15:15:09.587",
  "lastModified": "2023-12-21T18:15:38.237",
  "vulnStatus": "Awaiting Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the application tries to allow youtube.com URLs, but actually allows youtube.com followed by an @ character and an attacker-controlled domain name."
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://co3us.gitbook.io/write-ups/stored-xss-in-email-body-of-smartermail-cve-2023-48114",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.smartertools.com/smartermail/release-notes/current",
      "source": "cve@mitre.org"
    }
  ]
}