中 6.1

Zipline before 3.7.12 XSS via url parameter on login page

CVE-2025-71462 SecPulse初出 18:37

概要

Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login.

影響パッケージ

種類	パッケージ	影響を受ける版 → 修正版	修正版
diced	dicedzipline	3.7.12 未満→ 3.7.12	3.7.12

参照URL

• advisory GitHub Security Advisory (GHSA-m288-p6wr-m6gv)
• advisory VulnCheck Advisory: Zipline before 3.7.12 XSS via url parameter on login page