| Package | Affected versions | Patched versions |
|---|---|---|
| orangescrum | = 1.8.0 |
Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input parameters. Attackers can exploit parameters like 'projid', 'CS_message', and 'name' to execute arbitrary JavaScript code in victim's browsers by submitting crafted payloads through application endpoints.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free