@nexgin/totaljsapplication (>=0.0.1, <=0.0.66) potentially affected by CVE-2023-30094 via total4 (0.0.80)

total4 NPM version 0.0.80 is affected by a known vulnerability. The following packages have a transitive dependency on total4 and may be impacted: - @nexgin/totaljsapplication =0.0.1, =0.0.66 Source cves: CVE-2023-30094 Source advisory: OSV:GHSA-JJ45-24RW-V6JW...

CVE-2023-30094

A stored cross-site scripting XSS vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module...

CVE-2023-30094

TotalJS Flow v10 is affected by a stored XSS in the platform name field of the Settings module (CVE-2023-30094). The vulnerability allows an attacker to inject and execute arbitrary scripts/HTML in the victim’s browser. Root cause appears to be insufficient input sanitization in related code path...

CVE-2023-30094

A stored cross-site scripting XSS vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module...