Description
The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by workGroupList text.
Remediation
References
https://github.com/zlgxzswjy/BUI-select-xss
Related Vulnerabilities
CVE-2020-6427 Vulnerability in npm package electron
CVE-2023-45885 Vulnerability in npm package openmct
CVE-2022-36097 Vulnerability in maven package org.xwiki.platform:xwiki-platform-attachment-ui
CVE-2019-13236 Vulnerability in maven package org.opencms:opencms-core
CVE-2020-8137 Vulnerability in maven package org.webjars.npm:uppy