Formstone Vulnerable to Reflected XSS

Description

Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files.

Recommendation

Update the formstone package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.4.16
• Patched version(s): 1.4.17

References

• GHSA-wc29-h54q-q8qx
• CVE-2020-26768
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
• Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter - CVE-2020-19697
• Pandao Editor.md vulnerable to cross-site scripting (XSS) in editor parameter - CVE-2020-19698
• bracket-template vulnerable to reflected XSS - CVE-2018-3735

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

formstone