Threats tagged 'ghsa-5472-qhvw-4r4w'

DzzOffice 2.3.x contains a vulnerability in the comment editing template (dzz/comment/template/edit_form.htm) where user-controllable data is not properly escaped in HTML and JavaScript contexts. This flaw allows low-privilege attackers to inject and execute arbitrary JavaScript code when a victim opens the comment editing pop-up, potentially leading to cross-site scripting (XSS).