CVE-2022-23051

PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the 'svgfile' parameter...

CVE-2022-23051

PeteReport Version 0.5 contains an authenticated-admin Cross-Site Scripting (XSS) vulnerability: by modifying the svg_file parameter while adding an Attack Tree, an admin can inject persistent JavaScript. The issue stems from lack of filtering/escaping of user data. Affected product appears to be...