GHSA-pc95-3wgm-x28p

VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-29271

Packages

Ecosystem	Package	Affected	Fixed in
npm	vvvebjs	< 1.7.5	1.7.5

Details

As written in the advisory (Markdown source, shown as plain text).

A reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.5 allows remote attackers to execute arbitrary code and obtain sensitive information via the `action` parameter in `save.php`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-29271 advisory
https://github.com/givanz/VvvebJs/issues/342 web
https://github.com/givanz/VvvebJs/commit/c0c0545b44b23acc288ef907fb498ce15b9b576e web
https://github.com/givanz/VvvebJs package