Threats tagged 'ghsa-mcpq-xxxj-mc69'

AIL Framework versions up to 7.0.0 contain a reflected cross-site scripting (XSS) vulnerability in the /tag/add_tags endpoint. The vulnerability occurs because error messages include attacker-controlled input directly in HTML responses without proper encoding. Exploitation requires an authenticated user to interact with a crafted link, potentially allowing execution of arbitrary JavaScript in the victim's browser within the application's security context. This could enable actions such as session hijacking or data modification based on the victim's privileges.