Energytag6

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Authenticated users can read financial data beyond their permitted role due to missing authorization checks. This allows attackers to query endpoints to access sensitive financial records that should be restricted.