Threats tagged 'ghsa-x22m-wwr6-j767'

A cross-site scripting (XSS) vulnerability exists in qianfox FoxCMS up to version 1.2.16 in the add/edit function of app/admin/controller/Product.php. This flaw allows remote attackers to manipulate the Title argument to execute script code. The vulnerability has a low CVSS score of 2.4 and requires high privileges and user interaction to exploit. The vendor has not responded to disclosure attempts, and no patch is currently available. Public exploit code has been published.