Threats tagged 'ghsa-9chh-cmwc-p8fx'

A Cross-Site Scripting (XSS) vulnerability in SourceCodester AI Font Matcher allows remote attackers to execute arbitrary JavaScript in victims' browsers by injecting malicious payloads through unsanitized font family names in the webfonts API. This can lead to session cookie theft, account hijacking, and unauthorized actions performed on behalf of authenticated users.