Threats tagged 'ghsa-44vv-c6pr-wrhx'

A cross-site scripting (XSS) vulnerability exists in Opixido OCMS in the admin/TUI/index.php component due to improper handling of the 'img' argument. This flaw allows remote attackers to inject malicious scripts. The product uses continuous delivery with rolling releases, so specific affected or fixed versions are not available. The vendor did not respond to early disclosure attempts. Exploit code has been published. The CVSS score is 4.3, indicating medium severity.