Description
The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by workGroupList text.
Remediation
References
https://github.com/zlgxzswjy/BUI-select-xss
Related Vulnerabilities
CVE-2020-28469 Vulnerability in npm package glob-parent
CVE-2019-18213 Vulnerability in maven package org.lsp4xml:lsp4xml-extensions
CVE-2018-20822 Vulnerability in npm package node-sass
CVE-2010-1870 Vulnerability in maven package com.opensymphony:xwork-core
CVE-2023-46589 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core