XSS vulnerability
-
There’s a security issue with the way you populate the form action using the current URL, $_SERVER[‘REQUEST_URI’] needs to be escaped, otherwise an attacker could forge a URL to inject <script> content in the page.
Please see a fix here: https://github.com/exelab/genesis-enews-extended/commit/39c9952724d4e7aa9f99f13cb11c7bd81dfd537d
Viewing 3 replies - 1 through 3 (of 3 total)
Viewing 3 replies - 1 through 3 (of 3 total)
- The topic ‘XSS vulnerability’ is closed to new replies.