GitHub Advisoryadvisory · npm

GHSA-xgj4-2hrf-j4xg Cross-site scripting in Survey Creator

MEDIUM Published 2024-03-21 Modified 2026-06-11 Official page ↗
Aliases
CVE-2024-28635
Ecosystem
npm
Packages
survey-creator
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-03-21

Affected packages

• npm survey-creator: < 1.9.133 → fixed in 1.9.133

Description

Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.

Related

Alias · CVE (1)

  • CVE-2024-28635 Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References