Description
ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.
Remediation
References
https://github.com/ruibaby/halo/issues/9
Related Vulnerabilities
CVE-2016-3088 Vulnerability in maven package org.apache.activemq:activemq-fileserver
CVE-2020-7691 Vulnerability in maven package org.webjars.npm:jspdf
CVE-2021-21342 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2021-44878 Vulnerability in maven package org.pac4j:pac4j-core
CVE-2022-1291 Vulnerability in maven package org.webjars.npm:tableexport.jquery.plugin