Bruno Kovacs

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved through various parameters in different API endpoints, including: the `url` or `type` parameter to "docs/examples/redirect.spy"; the `x` parameter to "docs/examples/handlervalidate.spy"; the `name` parameter to "spyce/examples/request.spy"; the `Name` parameter to "spyce/examples/getpost.spy"; the `mytextarea`, `mypass`, or an empty parameter to "spyce/examples/formtag.spy"; the `newline` parameter to the default URI under "demos/chat/"; the `text1` parameter to "docs/examples/formintro.spy"; or the `mytext` or `mydate` parameter to "docs/examples/formtag.spy".

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the `url` parameter. This can be exploited by providing a malicious URL to the vulnerable application.

The issue allows remote attackers to obtain sensitive information via a direct request for "spyce/examples/automaton.spy", which reveals the path in an error message.