GHSA-RX7M-WXWQ-VXR9 AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

Summary AdminNeo inserts the database server's version string into a tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code. Because the script tag already has ...