Dejan Bosanac

A cross-site scripting (XSS) issue exists in the Portfolio publisher servlet within the demo web application. This allows remote attackers to inject arbitrary web script or HTML via the `refresh` parameter to the "demo/portfolioPublish" API endpoint.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message." This could potentially lead to unauthorized actions on the web application.

The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various vectors, including the `refresh` parameter to `PortfolioPublishServlet.java`, debug logs, or subscribe messages in `webapp/websocket/chat.js`.