Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page

Description

Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability.

Recommendation

Update the @saltcorn/server package to the latest compatible version. Followings are version details:

Affected version(s): < 1.0.0-beta.16
Patched version(s): 1.0.0-beta.16

References

GHSA-pf56-h9qf-rxq4
CWE-79
OWASP 2021-A3

Could your website be exposed too?

SmartScanner can check your website for Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page and gives you actionable findings to investigate.

Start a free scan

Related Issues

NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability - CVE-2026-30048
wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function - CVE-2022-25037
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas - Vulnerability
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas - Vulnerability

How to Secure your NodeJs Express Javascript Application - part 1

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

See something that needs correcting? Let us knowUpdated October 07, 2024