| 제목 | kerwincui FastBee ≤ 1.2.1 Improper Neutralization of Alternate XSS Syntax |
|---|
| 설명 | FastBee contains a stored XSS vulnerability in the system notice feature. The noticeContent field is accepted by the backend and stored in the database without HTML sanitization. When users open the homepage notice detail dialog, the frontend renders the stored notice content through v-html, causing attacker-controlled JavaScript to execute in the victim's browser. |
|---|
| 원천 | ⚠️ https://fx4tqqfvdw4.feishu.cn/docx/Iu5Dd558UoS4uIxhH9YcgNsWnjc?from=from_copylink |
|---|
| 사용자 | xcxr (UID 86629) |
|---|
| 제출 | 2026. 04. 09. AM 04:50 (5 개월 ago) |
|---|
| 모더레이션 | 2026. 05. 02. AM 10:35 (23 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 360830 [kerwincui FastBee 까지 1.2.1 System Notice SysNoticeController.java add noticeContent 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 18 |
|---|