Threats tagged 'ghsa-jgpm-4mcp-wmvj'

A low-severity cross-site scripting (XSS) vulnerability exists in Bdtask/CodeCanyon SalesERP versions up to 20250728. The flaw is in the User Profile Handler component, specifically in the /edit_profile endpoint, where manipulation of the first_name or last_name parameters can lead to basic XSS. The vulnerability can be exploited remotely and requires user interaction. The vendor was notified but has not responded or provided a fix. Exploit code has been published.