Threats tagged 'ghsa-cqpq-mfhw-4pgq'

DjangoBlog versions between commit d186b1c and commit 6134ed6 contain a stored cross-site scripting (XSS) vulnerability. Authenticated OAuth users can exploit this by injecting malicious script through an unescaped nickname in comment reactions. This allows attackers to execute arbitrary script in the browsers of visitors viewing the affected articles.