1 matches found
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text
Summary When passing an unknown service name to embedvideo, an error message is rendered containing the invalid service name. The service name is not sanitized and can contain HTML. Details There is a hardcoded list of allowed services in a switch statement inside EmbedServiceFactorynewFromName...
7.5CVSS6AI score0.00295EPSS
SaveExploits0References4Affected Software1
20