PT-2026-60098

Summary Two filter-bypass techniques in NukeVietCoreRequest::filterAttr and NukeVietCoreRequest::unhtmlentities allow a low-privileged user any account with news post permission to store and serve arbitrary JavaScript to any visitor of the affected page. Affected Component...