CVE-2026-120443

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executi...

CVE-2026-120443

The GoFound application (versions through 1.4.1 ) is vulnerable to a stored cross-site scripting (XSS) flaw. An unauthenticated attacker can inject malicious scripts by submitting document text to the /api/index endpoint. The vulnerability occurs because the searcher/engine.go component returns u...

EUVD-2026-115203

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executi...