Cross-site Scripting (XSS)

miniflux.app is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the mediaProxy function of proxy.go due to the unescaped ServerError in proxy handler when opening a broken image, allowing an attacker to inject and execute malicious javascript...