| عنوان | kerwincui FastBee ≤ 1.2.1 Improper Neutralization of Alternate XSS Syntax |
|---|
| الوصف | FastBee contains a stored XSS vulnerability in the system notice feature. The noticeContent field is accepted by the backend and stored in the database without HTML sanitization. When users open the homepage notice detail dialog, the frontend renders the stored notice content through v-html, causing attacker-controlled JavaScript to execute in the victim's browser. |
|---|
| المصدر | ⚠️ https://fx4tqqfvdw4.feishu.cn/docx/Iu5Dd558UoS4uIxhH9YcgNsWnjc?from=from_copylink |
|---|
| المستخدم | xcxr (UID 86629) |
|---|
| ارسال | 09/04/2026 04:50 AM (4 أشهر منذ) |
|---|
| الاعتدال | 02/05/2026 10:35 AM (23 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 360830 [kerwincui FastBee حتى 1.2.1 System Notice SysNoticeController.java add noticeContent البرمجة عبر المواقع] |
|---|
| النقاط | 18 |
|---|