Description
Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution.
Unscored
CVE-2016-11020
EUVD-2016-2011GHSA-gffh-9h9q-xv2h
Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution.
Published Feb 24, 2020 · Updated Aug 6, 2024 · Assigned by mitre