PYSEC-2023-294 - An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable appli

Severity: low · CVSS 3.1 · Published 2023-12-13

Technologies: repox (PyPI). Vendors: PyPI.

Executive brief

An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable application, and can be exploited by a third party by sending a specially crafted JavaScript payload to a user, and thus gain full control of their session.

Affected products

PyPI repox

Related threats

PYSEC-2023-297 - A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting
PYSEC-2023-296 - An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the
PYSEC-2023-295 - An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on t
PYSEC-2023-293 - An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to