CVE-2021-32608

An issue was discovered in Smartstore aka SmartStoreNET through 4.1.1. Views/Boards/Partials/ForumPost.cshtml does not call HtmlUtils.SanitizeHtml on certain text for a forum post...

CVE-2021-32608

CVE-2021-32608 affects SmartStoreNET up to version 4.1.1. The root cause is that Views/Boards/Partials/_ForumPost.cshtml renders user-controlled forum post text (FormattedText) without persistent sanitization, enabling a sanitize-then-transform issue. The vulnerability is demonstrated via Cross-S...