PT-2026-135459
CVE-2026-120443
·
Published
2026-11-02
·
Updated
2026-11-02
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾