Rodolfo Tavares

Improper escaping flags in schema.org markup outputs create a Cross-Site Scripting (XSS) vector. XSS is a security flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.

The issue arises from Bruno's use of Electron's `shell.openExternal` function without proper validation of URLs, specifically `http` or `https`, when opening windows within the Markdown docs viewer. This lack of validation can lead to unvalidated URL handling.

A cross-site scripting (XSS) issue in the UrlAccessibilityEvaluation.jsp component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `contentHtml` parameter.

A hardcoded privileged ID allows attackers to bypass authentication and access internal pages and other sensitive information.

A cross-site scripting (XSS) issue in the main.jsp component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `pageId` parameter.

A cross-site scripting (XSS) issue in the XsltResultControllerHtml.jsp component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `lumPageID` parameter.

The issue allows high privilege users to read any file from the web server via a Traversal attack due to the plugin not sanitising and validating a parameter before using it to read the content of a file.