The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub