Authorization Bypass

org.apache.isis is vulnerable to authorization bypass. The vulnerability exists in multiple functions when running prototype mode in the h2 webconsole module which allows an remote attacker to grant authorizations directly to the query database in prototype mode...

Cross-Site Scripting (XSS)

org.apache.isis is vulnerable to cross-site scripting. The vulnerability exists in multiple functions due to incorrectly neutralized user-controllable input allowing an attacker to inject and execute malicious JavaScript...