Threats tagged 'ghsa-rvvf-8m26-2qwr'

Vikunja versions prior to 2.7.1 have a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. This can be exploited by storing crafted task descriptions or comments to create phishing overlays or force background-image requests that can deanonymize viewers.