Описание
All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as <not-a-tag />) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerability can be exploited when the user-input is provided to the autocomplete component.
Ссылки
- Broken Link
- ExploitThird Party Advisory
- ExploitThird Party Advisory
- Broken Link
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:materializecss:materialize:*:*:*:*:*:*:node.js:*
EPSS
Процентиль: 53%
0.00301
Низкий
5.4 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 5.4
debian
почти 4 года назад
All versions of package materialize-css are vulnerable to Cross-site S ...
CVSS3: 5.4
github
почти 4 года назад
materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input
EPSS
Процентиль: 53%
0.00301
Низкий
5.4 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79