Threats tagged 'ghsa-4h7f-6q5m-3p6f'

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SelfBest platform version 2023.3. This flaw allows attackers to execute arbitrary JavaScript within the context of a logged-in user's session by injecting malicious payloads through the browser's developer console. The vulnerability is due to insufficient sanitization of client-side DOM manipulation and lack of a Content Security Policy (CSP). Exploitation could lead to account takeover and data theft.