Vikunja has Reflected HTML Injection via filter Parameter in Projects Module
Résumé
Vikunja has Reflected HTML Injection via filter Parameter in Projects Module
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module where the filter URL parameter is rendered into the DOM without output encoding when the user clicks "Filter." While and are blocked, , , and formatting tags (, , ``) render without restriction — enabling SVG-based phishing buttons, external redirect links, and content spoofing within the trusted application origin. Version 2.0.0 fixes this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web vikunja.io