PT-2020-14233

Name of the Vulnerable Software and Affected Versions nodebb-plugin-blog-comments versions prior to 0.7.0 Description The issue is due to a lack of CSRF validation, making a logged-in user potentially vulnerable to an XSS attack. This could allow a third party to post on the user's behalf on the...

cross-site scripting through window.controllers — Mozilla

shutdown demonstrated how to use the window.controllers array to bypass same-origin protections, allowing a malicious site to inject script into content from another site. This could allow the malicious page to steal information such as cookies or passwords from the other site, or perform...