Description (CNA)
The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Larvata Digital Technology Co. Ltd. / FLYGO | affected unspecified through 2021.4e |
CWE
CWE-79
References
ADP enrichment
No English description supplied.