A Stored Cross‑Site Scripting vulnerability exists in Uploady prior to version 3.1.2 because filenames are not properly sanitized. An attacker can upload a file with a malicious filename containing JavaScript. When the filename is displayed in the file list or details page, the script runs in the browser of any user who views that page. The vulnerability does not provide any additional impact beyond the execution of client‑side code in the context of each viewer.

The affected product is Uploady by farisc0de. All releases before version 3.1.2 are vulnerable; the issue is fixed in 3.1.2 and later. No other vendors or products are listed as affected.

The CVSS score is 4.6, indicating moderate severity, while the EPSS score is below 1 %, implying low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the file‑upload interface; no special privileges beyond normal upload usage are required. The consequence is that any user who views the file’s details may have their browser affected, but no escalated privileges or data leakage are described in the CVE. Because the impact is limited to the browser context of each viewer, the overall risk is considered moderate and depends on the site’s user base and trust model.