Description

ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.

Remediation

References

https://github.com/ruibaby/halo/issues/9

Related Vulnerabilities

CVE-2022-21164 Vulnerability in npm package node-lmdb

CVE-2023-49371 Vulnerability in maven package com.ruoyi:ruoyi

CVE-2021-32822 Vulnerability in npm package hbs

CVE-2019-5427 Vulnerability in maven package com.mchange:c3p0

CVE-2023-38691 Vulnerability in npm package matrix-appservice-bridge

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Issue Tracking Third Party Advisory