Cross Site Scripting (XSS)

org.opencrx: opencrx-core-models is vulnerable to HTML Injection. The vulnerability is due to a lack of proper input sanitization in the Product Configuration Name Field. This allows an attacker to inject malicious HTML into the application...

Information Disclosure

org.opencrx:opencrx-core is vulnerable to information disclosure. A remote attacker is able to determine if a username, email or an ID is valid through password enumeration due to the difference in error messages received during a password reset...