Unrated
LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen.
CVE-2019-17434
First seen on SecPulse
References
- report github.com