Threats tagged 'ghsa-9pxg-37r7-g742'

NextScan versions 1.1.0 through 1.2.0 have a stored cross-site scripting (XSS) vulnerability in the ns-admin URL asset detail dialog. This flaw occurs because the application renders crawled form request bodies using innerHTML without proper encoding. An attacker can exploit this by hosting malicious forms on crawled sites, which store JavaScript that executes when users view asset details. This can lead to theft of localStorage access tokens and session hijacking, including for administrator accounts.