Forceu Vulnerabilities

This vulnerability allows an attacker to inject malicious JavaScript into the API key overview, which can then execute when another user views that section. It affects all authenticated users before version 2.0.0, as there were no permissions to restrict access, but if a user is the only one using Gokapi, they are not at risk.

An attacker can exploit a flaw in Gokapi to upload a file with malicious JavaScript in its name, which runs every time the upload list is viewed, potentially allowing them to execute harmful actions on the server. This vulnerability primarily affects systems before version 2.0.0, where all authenticated users could access and modify all files, making it easier for an attacker if multiple users are present.