Threats tagged 'ghsa-867h-r58x-95cx'

BuildAdmin versions 1.0.1 through 2.3.9 are affected by a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious javascript: URLs into the admin operation log via the X-Rewrite-URL header. When an administrator clicks the URL open button in the log entry, the injected script executes in the backend origin, stealing the adminInfo token from localStorage and enabling account takeover.