Cross-site Scripting (XSS)

2023-01-1800:35:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

xss attacks

vova07/yii2-fileapi-widget

front end

malicious javascript

uploadaction.php

EPSS

0.001

Percentile

37.1%

JSON

vova07/yii2-fileapi-widget is vulnerable to Cross-Site Scripting (XSS) attacks. The library does not properly escape the special characters before it output to the front end, allowing an attacker to inject and execute malicious JavaScript via the vulnerable run function in UploadAction.php.