Threats tagged 'ghsa-xc7j-3g8q-9vh4'

YesWiki's Bazar form-field templates contain stored cross-site scripting (XSS) vulnerabilities due to unsafe use of Twig's raw('html') filter on user-controllable field.label and field.hint values. These fields are populated from form definitions editable by users with high privileges (typically admins). The vulnerability allows injection of malicious HTML or event handlers in form attributes and label bodies, potentially affecting all users viewing the forms. The issue persists in multiple templates beyond those fixed in a prior commit. The CVSS 3.1 vector rates this as medium severity with a score of 4.7.