Script Injection

smartbanner.jss is vulnerable to Script Injection. The vulnerability is due to window.opener being accessible to third-party pages when users click the View link, allowing attackers to manipulate the original page via redirection or script injection...

CVE-2025-25300 smartbanner.js rel noopener XSS vulnerability

smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile third parties to abuse window.opener, e.g. by redirection or injection on the...

CVE-2025-25300

CVE-2025-25300 concerns smartbanner.js (pre-1.14.1) where clicking the View link could expose window.opener to a 3rd party page, enabling possible redirection or script manipulation on the original page. The issue is addressed in version 1.14.1 by automatically applying rel="noopener" to links. I...

GHSA-9MRQ-CJGH-32G2 smartbanner.js rel noopener vulnerability

rel noopener vulnerability Impact Clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile 3rd parties to abuse window.opener, e.g. by redirection or injection on the original page with smartbanner. Patches rel="noopener" is automatical...