GHSA-pq95-94c9-j987
yaffa vulnerable to Cross Site Scripting
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | kantorge/yaffa | <= 2.0.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.
References
External links from the advisory. They lead to third-party sites.