GHSA-rvf8-c35m-8289

Lin-CMS-Flask Cross Site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-18699

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	lin-cms	<= 0.1.1b2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-18699 advisory
https://github.com/TaleLin/lin-cms-flask/issues/28 web
https://github.com/TaleLin/lin-cms-flask package
https://github.com/pypa/advisory-database/tree/main/vulns/lin-cms/PYSEC-2021-340.yaml web