Threats tagged 'ghsa-vjwh-8w5h-gwj6'

CVE-2026-117493 is a stored cross-site scripting (XSS) vulnerability in BloX widgets. The API endpoint /api/dashboards/<id>/widgets/<id> accepts HTML and JavaScript content in the 'desc' and 'text' parameters, which is executed in the browser when the widget is rendered. This can lead to compromise of confidentiality of information accessible in that context.