| Package | Affected versions | Patched versions |
|---|---|---|
| codoforum | ≤ 4.8.4 |
Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cookies and take over accounts.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free