GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Link | Tags |
---|---|
https://herolab.usd.de/security-advisories/usd-2023-0019/ | third party advisory exploit |