Cross-site Scripting (XSS)

2021-02-0106:52:23

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

flarum/sticky

cross-site scripting

mithril's m.trust()

EPSS

0.005

Percentile

77.2%

JSON

flarum/sticky is vulnerable to cross-site scripting. An attacker with the ability to pin their own discussion, or be able to edit a discussion that was previously pinned is able to inject and execute an arbitrary script via Mithril’s m.trust() helper while the extension is enabled.