S3Zer0

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to cause a denial of service over a network. Specifically, Minimal API validation repeatedly copies a growing validation-error dictionary, which enables attacker-controlled collections to trigger quadratic CPU work after the client disconnects.

An inappropriate implementation in the SanitizerAPI allows a remote attacker to inject arbitrary scripts or HTML, leading to Universal Cross-Site Scripting (UXSS), which is a vulnerability that allows an attacker to execute scripts across different origins, by using a crafted HTML page.