CVE-2023-26771

Taskcafe 0.3.2 is vulnerable to Cross Site Scripting (XSS). There is a lack of validation in the filetype when uploading a SVG profile picture with a XSS payload on it. An authenticated attacker can exploit this vulnerability by uploading a malicious picture which will trigger the payload when the victim opens the file.

• CWE-79

• https://bishopfox.com/blog/taskcafe-version-0-3-2-advisoryExploit, Third Party Advisory
• https://github.com/JordanKnott/taskcafeProduct

Published

Oct 4, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26762Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an ar…8.8
• CVE-2023-26767Buffer Overflow vulnerability found in Liblouis v.3.24.0 all…7.5
• CVE-2023-26768Buffer Overflow vulnerability found in Liblouis v.3.24.0 all…7.5
• CVE-2023-26769Buffer Overflow vulnerability found in Liblouis Lou_Trace v.…7.5
• CVE-2023-2677A vulnerability, which was classified as critical, was found…8.8
• CVE-2023-26770TaskCafe 0.3.2 lacks validation in the Cookie value. Any una…9.8
• CVE-2023-26773Cross Site Scripting vulnerability found in Sales Tracker Ma…6.1
• CVE-2023-26774An issue found in Sales Tracker Management System v.1.0 allo…7.5
• CVE-2023-26775File Upload vulnerability found in Monitorr v.1.7.6 allows a…7.8
• CVE-2023-26776Cross Site Scripting vulnerability found in Monitorr v.1.7.6…6.1
• CVE-2023-26777Cross Site Scripting vulnerability found in : louislam Uptim…6.1
• CVE-2023-26779CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserializa…9.8