Junroinxxx

**Name of the Vulnerable Software and Affected Versions** quequnlong shiyi-blog versions prior to 1.2.2 **Description** A remote cross site scripting issue exists in the Add Message API component within the file blog-admin/src/views/message/message/index.vue. The flaw allows for the manipulation of the `body.content` argument, enabling an attacker to execute malicious scripts in the victim's browser. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `body.content` parameter in the Add Message API until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** TDuckApp tduck-platform versions prior to 5.4 **Description** A flaw in the Form Write View component, specifically within the file `tduck-front/src/views/form/write/index.vue`, allows for remote cross-site scripting. This occurs through the manipulation of the `submitShowCustomPageContent` argument. Cross-site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DataEase versions 2.10.25 through 2.10.26 **Description** A remote cross site scripting issue exists in the Symbolic Map component. The problem occurs within the `buildTooltip()` function located in the `core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts` file. An attacker can exploit this by manipulating the `canvasViewInfo[*].customAttr.tooltip.backgroundColor` variable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** maliangnansheng bbs-springboot version 3.0.0 **Description** A remote cross site scripting issue exists within the `utils.toToc()` function of the `ArticleController.java` file. Cross site scripting is a technique where malicious scripts are injected into trusted websites, which are then executed in the browser of the user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `utils.toToc()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** quequnlong shiyi-blog versions 1.0.0 through 1.2.1 **Description** A remote cross site scripting issue exists in the chat sendMsg endpoint. The flaw is located within the `SysChatMsgMapper.getChatMsgList()` function in the file blog-web/src/views/chat/index.vue. An attacker can exploit this by manipulating the `chat msg` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the chat sendMsg endpoint or avoid using the `chat msg` argument until a patch is available.

**Name of the Vulnerable Software and Affected Versions** quequnlong shiyi-blog versions prior to 1.2.2 **Description** A remote cross site scripting issue exists in the Search component within the file blog-web/src/components/Search/index.vue. The flaw occurs in the `highlightKeyword()` function when processing the `title` or `summary` arguments, allowing an attacker to execute malicious scripts. **Recommendations** Update to a version newer than 1.2.1. As a temporary workaround, restrict the use of the `highlightKeyword()` function until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** moxi624 Mogu Blog v2 versions prior to 5.3 **Description** A remote cross site scripting issue exists in the blogSort endpoint. The problem occurs within the `BlogSortServiceImpl.addBlogSort()` function located in the `mogu web/src/main/resources/templates/info.ftl` file. An attacker can exploit this by manipulating the `sortName` argument. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `BlogSortServiceImpl.addBlogSort()` function or avoid using the `sortName` argument in the blogSort endpoint.

**Name of the Vulnerable Software and Affected Versions** linlinjava litemall versions 1.5.0 through 1.8.0 **Description** A flaw in the Admin Topic Handler component allows for remote cross site scripting (XSS), a technique where malicious scripts are injected into trusted websites. The issue resides within the `AdminTopicController.validate()` function located in the `litemall-vue/src/views/items/topic/index.vue` file. **Recommendations** As a temporary workaround, consider restricting the use of the `AdminTopicController.validate()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** linlinjava litemall versions 1.4.0 through 1.8.0 **Description** A remote cross site scripting issue exists in the Product Detail component within the file litemall-vue/src/views/items/detail/index.vue. The flaw occurs when the `detail` argument is manipulated within the `AdminGoodsService.validate()` function, allowing an attacker to execute malicious scripts in the victim's browser. **Recommendations** As a temporary workaround, restrict access to the `AdminGoodsService.validate()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Exrick xmall versions up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c **Description** An issue exists in the Order Printing component within the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp. A manipulation of an unknown function in this file allows for remote cross site scripting, a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp to minimize the risk of exploitation.