Threats tagged 'ghsa-3mcr-px3q-mcw8'

PostfixAdmin versions through 4.0.5 have a stored cross-site scripting (XSS) vulnerability that affects authenticated mailbox users. This flaw allows these users to inject malicious scripts via the description field when creating a TOTP exception. When a global administrator views the affected page, the injected script executes in the admin's session context, potentially allowing unauthorized admin actions using the page's CSRF token.