Description
The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by workGroupList text.
Remediation
References
https://github.com/zlgxzswjy/BUI-select-xss
Related Vulnerabilities
CVE-2016-3081 Vulnerability in maven package org.apache.struts.xwork:xwork-core
CVE-2019-14653 Vulnerability in maven package org.webjars.bowergithub.pandao:editor.md
CVE-2021-22964 Vulnerability in npm package fastify-static
CVE-2020-7719 Vulnerability in npm package locutus
CVE-2023-34462 Vulnerability in maven package io.netty:netty-handler