Threats tagged 'ghsa-g738-fv3j-jj4w'

blueprintUE Self-Hosted Edition versions prior to 4.3.6 have an iframe injection vulnerability. Authenticated users can exploit this by embedding arbitrary third-party content via the PeerTube video URL matcher. This allows loading attacker-controlled content in an unsandboxed iframe after user consent, potentially framing fake login forms or malware downloads. The vulnerability has a low CVSS score of 3.5 and requires user interaction.