Node.js third-party modules: [tianma-static] Security issue with XSS.

I would like to report XSS in tianma-static It allows XSS and HTML Injection First of all, It is my first report and I am sorry that I am not good at English T.T thank you. Module module name: tianma-static version: 1.0.4 npm page: https://www.npmjs.com/package/tianma-static Module Description...

whistle.combo (>=1.0.0 <=1.0.2) potentially affected by CVE-2018-16474 via tianma-static (=1.0.4)

tianma-static NPM version =1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on tianma-static and may be impacted: - whistle.combo =1.0.0, =1.0.2 Source cves: CVE-2018-16474 Source advisory: OSV:GHSA-JHGP-HVJ6-X2P2...

CVE-2018-16474

CVE-2018-16474 concerns the Node.js module tianma-static . Concrete details show that all versions up to 1.0.4 are vulnerable to a stored XSS if an attacker can control the name of a file served by the module. Affected condition: filenames unsanitized, enabling arbitrary JavaScript execution when...

db.etree.org XSS vulnerability

Open Bug Bounty ID: OBB-664322 Description| Value ---|--- Affected Website:| db.etree.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...