medium6.1
CVE-2021-30134
php-mod/curl allows Cross-site Scripting
Impact
php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the `post_file_path_upload.php` key parameter and the POST data to `post_multidimensional.php`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | php-mod/curl | < 2.3.2 | 2.3.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Php Curl Class Project | Php Curl Class | before 2.3.2 |
| Ht Slider Range For Amazon Affiliates Project | Ht Slider Range For Amazon Affiliates | before 1.1.6 |
| Qiwi | Woo-Qiwi-Payment-Gateway | through 0.0.9 |
| Teamleade | Teamleader Crm Forms | before 2.1.0 |
| Ptwooplugins | Invoicing With Invoicexpress For Woocommerce | before 3.0.3 |
| Shopello Api Project | Shopello Api | through 2.9.0 |