Threats tagged 'ghsa-rx7m-wxwq-vxr9'

AdminNeo versions prior to 5.5.1 are vulnerable to a cross-site scripting (XSS) attack due to unsanitized insertion of the MySQL server version string into a script tag with a valid Content Security Policy (CSP) nonce. An attacker controlling a reachable MySQL server can craft a malicious version string that breaks out of the JavaScript context and executes arbitrary code in the victim's browser. This vulnerability requires no authentication when combined with login CSRF. A fix is available in version 5.5.1.