TravianZ through 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie.

参照URL

• advisory github.com
• advisory nvd.nist.gov
• web bramdoessecurity.com