Stored Cross-site Scripting (XSS)

2023-02-1306:35:11

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

wallabag

stored cross-site scripting

share.html.twig

html elements

javascript

name field

EPSS

0.001

Percentile

25.5%

JSON

wallabag/wallabag is vulnerable to Stored Cross-site Scripting (XSS). The vulnerability exists in share.html.twig due to lack of validations on HTML elements, which allows an attacker to inject and execute malicious JavaScript though the name field.