Threats tagged 'ghsa-h87p-q65v-qqrr'

A cross-site scripting (XSS) vulnerability exists in Dianping CAT versions 3.0.0, 3.1.0, and 4.0-RC1. The flaw is in the Model.getDomain function within the Report Handler component, specifically in the WEB-INF/tags/hourlyReport.tag file. Remote attackers can exploit this vulnerability by manipulating the 'domain' argument. Public exploit code has been disclosed, but the vendor has not responded or provided a fix.