Cross-site Scripting (XSS)

2022-07-1309:05:11

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

30.9%

JSON

whoogle_search is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of data input in the HTTP error_message request allowing an attacker to inject maliciously crafted script via flask.render_template function in error.html.

CPENameOperatorVersion
whoogle-searchle0.7.1
whoogle-searchle0.7.1

CPE	Name	Operator	Version
	whoogle-search	le	0.7.1
	whoogle-search	le	0.7.1

References

github.com/benbusby/whoogle-search/blob/6d362ca5c7a00d2f691a2512461c5dfbfc01cbb3/app/routes.py#L448

github.com/benbusby/whoogle-search/blob/6d362ca5c7a00d2f691a2512461c5dfbfc01cbb3/app/routes.py%23L448

github.com/benbusby/whoogle-search/commit/abc30d7da3b5c67be7ce84d4699f327442d44606

0.001 Low

EPSS

Percentile

30.9%

JSON

Related for VERACODE:36336