CVE-2021-38619

The CVE-2021-38619 entry concerns openBaraza HCM 3.1.6, where improper neutralization of user-controllable input enables a stored XSS attack against an administrative user via hr/subscription.jsp, hr/application.jsp, and hr/index.jsp (with view=). Attack requires no authentication and is remote. ...