Gitea version 1.24.0 is susceptible to HTML Injection and potentially Reflected Cross-Site Scripting (XSS) through the 'description' parameter on the user settings page. The lack of proper sanitization of user-supplied HTML content allows malicious scripts to be executed in the user's browser, leading to potential attacks. An attacker can inject malicious HTML or JavaScript code into their profile description, which gets executed when saved, demonstrating the presence of the vulnerability.
This module exploits a command execution vulnerability in ZoneMinder Video Server version 1.24.0 to 1.25.0 which could be abused to allow authenticated users to execute arbitrary commands under the context of the web server user. The 'packageControl' function in the 'includes/actions.php' file calls 'exec()' with user controlled data from the 'runState' parameter.
Services By CQR