CVE-2024-34449

Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...

mintlistMint: Address that is in both merkle trees not correctly handled

Lines of code Vulnerability details Impact It is possible to set two merkle roots for the mintlist mintlistMerkleRoot1 and mintlistMerkleRoot2 and both trees are used in queries: require MerkleProof.verifymerkleProof, mintlistMerkleRoot1, leaf || MerkleProof.verifymerkleProof, mintlistMerkleRoot2...