Threats tagged 'ghsa-7gqw-xrp6-92rg'

A critical stored Cross-Site Scripting (XSS) vulnerability exists in the chat functionality of the SelfBest platform version 2023.3. Authenticated low-privileged attackers can exploit this flaw to execute arbitrary JavaScript in other users' sessions, potentially accessing administrative data and functions. This can lead to privilege escalation and full compromise of sensitive user data, including exfiltration of information from the /admin/users endpoint.