Threats tagged 'ghsa-vjvr-7hrq-r8p6'

CMSimple_XH version 1.8 contains a reflected cross-site scripting (XSS) vulnerability in its index.php router. The vulnerability arises because attacker-controlled path segments in the URL are not properly sanitized or encoded before being included in various HTML elements such as navigation links, breadcrumbs, search form actions, and footer links. This allows an attacker to craft a URL that executes arbitrary JavaScript in the browsers of users who visit the malicious link.