| Package | Affected versions | Patched versions |
|---|---|---|
| ledgersmb | ≥ 1.5.0, ≤ 1.5.30≥ 1.6.0, ≤ 1.6.33≥ 1.7.0, ≤ 1.7.32≥ 1.8.0, ≤ 1.8.17 |
LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free