Cross-Site Scripting in nextcloud-vue-collections

Versions of nextcloud-vue-collections prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code i...

Cross-site Scripting (XSS)

nextcloud-vue-collections is vulnerable to cross-site scripting XSS. The vulnerability exists when the value of v-tooltip is rendered through an insecure defaultHTML configuration...