| Title | https://github.com/otale/tale Tale Blog v2.0.5 Cross Site Scripting |
|---|
| Description | In the OptionsService class, the application does not properly validate or filter the `themeUrl` input. This oversight allows an attacker to inject malicious JavaScript code through URL manipulation. By crafting a malicious URL that includes executable HTML or JavaScript content, an attacker can exploit this vulnerability to perform a Cross-Site Scripting (XSS) attack. |
|---|
| Source | ⚠️ https://github.com/dragonkeep/cve/blob/main/Tale_Blog_xss.md |
|---|
| User | Dragonkeep (UID 62708) |
|---|
| Submission | 02/21/2025 09:20 (1 Year ago) |
|---|
| Moderation | 02/22/2025 14:16 (1 day later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 296561 [otale up to 2.0.5 header.html OptionsService logo_url cross site scripting] |
|---|
| Points | 18 |
|---|