Threats tagged 'ghsa-q6gm-432c-pmpq'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	5.1	CVE-2026-119735Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated Medium5.12026-11-02GCVE DatabaseCVE-2026-119735 Munshi (by Petpooja) versions before 2026-07-13 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious markup via item descriptions or messages in the Purchase Inquiry thread, which is improperly sanitized before being assigned to innerHTML. This allows JavaScript execution in the browser of other users viewing the thread, enabling full-page defacement that recurs on thread reopening. Report on CVE-2026-119735 Vulnerability CWE-79 #ghsa-q6gm-432c-pmpq	GCVE Database	2026-11-02

Page 1 of 1