Medium
6.1
Zipline before 3.7.12 XSS via url parameter on login page
CVE-2025-71462
First seen on SecPulse
Summary
Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login.
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| dicedzipline |
< 3.7.12→ 3.7.12 |
3.7.12 |