Threats tagged 'ghsa-h9g3-q89c-mhwg'

SSCMS version 7.4.0 has a reflected cross-site scripting (XSS) vulnerability in its STL processing endpoint. This flaw allows attackers to inject and execute arbitrary JavaScript by sending malicious STL template payloads to the /api/stl/actions/dynamic endpoint. The vulnerability arises from improper output encoding of JSON responses, which can lead to session hijacking, phishing, and unauthorized user actions.