Threat Intelligence Database

AIL Project's ail-framework contains a stored cross-site scripting (XSS) vulnerability in the translation controls for chat messages and forum posts. The vulnerability arises because message and post identifiers are inserted directly into inline JavaScript onclick handlers without proper encoding for JavaScript string literals. This allows an attacker to inject arbitrary JavaScript code if a specially crafted identifier is used. Exploitation requires a victim to click the affected translation button, causing the injected script to execute in the victim's browser under the AIL instance's security context.

AIL Framework versions up to 7.0.0 contain a stored cross-site scripting (XSS) vulnerability in the crawler domain view. This flaw allows an attacker to inject malicious JavaScript into stored URLs that are later embedded unsafely into a JavaScript onclick handler. Exploitation requires an authenticated analyst to interact with the malicious screenshot entry, potentially enabling session information access or unauthorized actions within the application context. The vulnerability is due to improper input neutralization and was fixed by applying Jinja's tojson filter to safely escape the URL before insertion.

AIL Framework versions up to 7.0.0 contain a reflected cross-site scripting (XSS) vulnerability in the /tag/add_tags endpoint. The vulnerability occurs because error messages include attacker-controlled input directly in HTML responses without proper encoding. Exploitation requires an authenticated user to interact with a crafted link, potentially allowing execution of arbitrary JavaScript in the victim's browser within the application's security context. This could enable actions such as session hijacking or data modification based on the victim's privileges.