brysontyrrell / brysontyrrell/PatchServer
XSS via JS Injection in "name"
Open
- Dominant language
- Python
- Stars
- 68
- Forks
- 11
- PR merge metrics
- No merged PRs in 30d
Description
There is a verified XSS vulnerability in the "name" variable for uploaded patch files. There is no input sanitization on the data contained in "name" which allows for injection of javascript code that could be utilized by an attacker.
Further exacerbating this issue is lack of authentication controls in the patch server software.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.