Threats tagged 'ghsa-44fg-83c3-2cjh'

vtenext versions prior to 25.02.2 have a reflected cross-site scripting (XSS) vulnerability in the HomeWidgetBlockList.php module. This flaw arises because unsanitized widgetId keys from the widgetInfoList JSON parameter are echoed back, allowing attackers to inject malicious HTML/JavaScript. Exploitation requires a logged-in user to submit a crafted POST request, which then executes JavaScript in the victim's session.