CVE-2023-40224

CVE-2023-40224 affects MISP version 2.4.174, with a cross-site scripting vulnerability in app/View/Events/index.ctp. The available connected sources consistently describe an XSS issue due to insufficient input filtering/escaping, enabling arbitrary script execution via crafted payloads in the aff...

CVE-2021-25325

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...