Description

ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.

Remediation

References

https://github.com/ruibaby/halo/issues/9

Related Vulnerabilities

CVE-2022-43429 Vulnerability in maven package com.compuware.jenkins:compuware-topaz-for-total-test

CVE-2021-23330 Vulnerability in npm package launchpad

CVE-2023-29523 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2022-25231 Vulnerability in npm package node-opcua

CVE-2021-42228 Vulnerability in npm package kindeditor

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Issue Tracking Third Party Advisory