Description
The getTip() method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip() method of Action Columns takes HTML-escaped data and un-escapes it. If the tooltip contains user-controlled data, an attacker could exploit this to create a cross-site scripting attack, even when developers took precautions and escaped data.
Remediation
References
Related Vulnerabilities
WordPress Plugin Private Only Multiple Vulnerabilities (3.5.1)
WordPress Plugin ACF Frontend display Arbitrary File Upload (2.0.5)
WordPress Plugin PDF Viewer Block for Gutenberg Cross-Site Scripting (1.0)
Oracle Database Server CVE-2012-1708 Vulnerability (CVE-2012-1708)
CakePHP Improper Input Validation Vulnerability (CVE-2010-4335)