Lyf123Lyf

A cross-site scripting (XSS) issue was found in OFCMS. The vulnerability is exploited via the `/admin/comn/service/update.json` API endpoint.

The issue is related to insecure permissions configured in the `user id` parameter at `SysUserController.java`, allowing attackers to access and arbitrarily modify users' personal information.

A cross-site scripting (XSS) issue exists, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Comment` text box at the "/ofcms/company-c-47" API endpoint.

A stored cross-site scripting issue in the Add a Button function allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `button name` text box.