Description
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
Remediation
References
https://github.com/xCss/Valine/issues/127
Related Vulnerabilities
CVE-2021-45105 Vulnerability in maven package org.apache.logging.log4j:log4j-core
CVE-2022-35915 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts-upgradeable
CVE-2021-32859 Vulnerability in npm package baremetrics-calendar
CVE-2023-37895 Vulnerability in maven package org.apache.jackrabbit:jackrabbit-standalone-components
CVE-2022-41252 Vulnerability in maven package org.jenkins-ci.plugins:cons3rt