Threats tagged 'ghsa-qv78-c8hc-438r'

OpenMage versions prior to 20.16.0 contain a stored Cross-Site Scripting (XSS) vulnerability in the admin notification interface. This flaw arises from unescaped translation strings and URLs in the admin notification grid renderer, allowing an attacker with administrative or translation privileges to inject malicious JavaScript. The vulnerability is exploitable when browsing the affected admin notifications page, potentially executing arbitrary scripts in the victim's browser. A fix is available in version 20.16.0.