Description
ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.
Remediation
References
https://github.com/ruibaby/halo/issues/9
Related Vulnerabilities
CVE-2022-31129 Vulnerability in maven package org.webjars.bower:moment
CVE-2022-2596 Vulnerability in npm package node-fetch
CVE-2020-28502 Vulnerability in npm package xmlhttprequest
CVE-2023-29215 Vulnerability in maven package org.apache.linkis:linkis-common
CVE-2022-24697 Vulnerability in maven package org.apache.kylin:kylin-core-common