Description

ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.

Remediation

References

https://github.com/ruibaby/halo/issues/9

Related Vulnerabilities

CVE-2018-3755 Vulnerability in npm package sexstatic

CVE-2023-31719 Vulnerability in npm package @frangoteam/fuxa

CVE-2020-7749 Vulnerability in npm package osm-static-maps

CVE-2021-40660 Vulnerability in maven package org.javadelight:delight-nashorn-sandbox

CVE-2019-16762 Vulnerability in npm package slpjs

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Issue Tracking Third Party Advisory