5 matches found
CVE-2020-28847
Cross Site Scripting XSS vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment...
@gitldy1013/vuepress-theme-ldy (>=1.1.2, <=1.1.3), @next-theme/plugins (>=0.0.2, <=8.1.0) +18 more potentially affected by CVE-2020-28847 via valine (>=1.3.6, <=1.4.14)
valine NPM version =1.3.6, =1.1.2, =0.0.2, =2.0.0-beta.0, =1.0.11-alpha.1, =0.0.1, =1.0.0, =1.0.0, =1.0.8-alpha.5, =1.1.2, =1.2.1, =1.0.1, =1.0.0, =1.1.4 and more Source cves: CVE-2020-28847 Source advisory: OSV:GHSA-6XVQ-2GJ8-4276...
CVE-2020-28847
creationtimestamp| type| source ---|---|--- 2022-04-05 20:28:55+00:00| seen| https://t.me/cibsecurity/40173...
CVE-2020-28847
CVE-2020-28847 affects Valine (xCss Valine) 1.4.14 due to insufficient sanitization of the nick parameter in /classes/Comment, enabling cross-site scripting. The issue is documented across multiple feeds; a fix was released in version 1.4.15. Impact is XSS with user-provided nick data stored/echo...
