Advisories for Npm/Jquery-File-Upload package

2022

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.

2018

Arbitrary file upload

The code in php/upload.php does not check for a file type or for requiring any authentication allowing a user to upload an executable file to the /uploads/ directory if it exists.