Oceanwarranty

A reflected cross-site scripting issue exists in the '/dbml/svg' endpoint. Unauthenticated attackers can inject `javascript:` hyperlinks by providing specially crafted values for the `url`, `headercolor`, or `TableGroup` color settings within a DBML table. This allows the execution of arbitrary JavaScript in the Kroki origin when a victim opens a crafted SVG link and clicks the table header.

An information disclosure issue exists in the '/api/v1/teams' endpoint. Unauthenticated attackers can use paginated GET requests to retrieve non-public team custom field values, such as emails, phone numbers, and student IDs, provided that team mode and public visibility are enabled.