Bug 2568479 (CVE-2026-120443)
| Summary: | CVE-2026-120443 github.com/sea-team/gofound: GoFound: Stored Cross-Site Scripting via document indexing | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in GoFound. This stored Cross-Site Scripting (XSS) vulnerability allows an unauthenticated remote attacker to execute arbitrary script code within an administrator's browser session. By submitting crafted document content containing malicious HTML to the indexing service, the payload is stored and subsequently rendered unescaped in the administrative dashboard search view. Successful exploitation can enable an attacker to perform unauthorized actions or access sensitive administrative information.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-06 19:41:25 UTC
|