DMP Roadmap before 3.0.4 allows XSS.
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Link | Tags |
---|---|
https://github.com/DMPRoadmap/roadmap/commit/0b83ad31ac01a709633080b134cfb6debc310c5e | third party advisory patch |
https://github.com/DMPRoadmap/roadmap/pull/3030 | third party advisory patch |
https://github.com/DMPRoadmap/roadmap/compare/v3.0.3...v3.0.4 | third party advisory patch |