Threats tagged 'ghsa-39g8-j5g5-gfjq'

Cloudron versions 9.1.7 and 9.2 have a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can inject malicious HTML with JavaScript event handlers into the Footer setting. This malicious code is rendered without proper sanitization on the public login/OpenID interaction page and in the System Event Log, allowing attacker-controlled JavaScript to execute within the Cloudron web origin when these pages are viewed.