habitica cross-site scripting vulnerability

habitica is an open source habit-forming program from the US-based HabitRPG. habitica versions v4.119.0 through v4.232.2 are vulnerable to a cross-site scripting vulnerability. The vulnerability stems from the program's lack of data validation filtering of user-supplied data and output. An attack...

CVE-2022-23078

CVE-2022-23078 affects Habitica versions v4.119.0–v4.232.2. The connected sources describe an open redirect vulnerability exploitable via the login page, with the root cause attributed to input handling that allows redirection to arbitrary URLs. Impact is described as a partial confidentiality/in...

CVE-2022-23077

Habitica (HabitRPG) versions 4.119.0–4.232.2 are affected by a DOM-based XSS on the login page. Root cause: insufficient validation/escaping of user-supplied data leading to reflected input in the DOM. Impact: cross-site scripting via the login page; potential for session/credential exposure if u...