CVE-2022-42746

CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks...

CVE-2022-42746

CandidATS 3.0.0 has a cross-site scripting (XSS) vulnerability via the indexFile parameter of ajax.php. The Nuclei template and related sources describe that an attacker can inject arbitrary script into the victim’s browser, enabling cookie-based credential theft and potential session hijacking. ...