Skip to content
OpenAdvisories

Product · Discourse

DiscoTOC

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.4
    CVE-2022-39270

    Arbitrary HTML injection in table-of-contents theme component in DiscoTOC

    DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories (and have sufficient trust level - configured in component's settings) are able to inject arbitrary HTML on that topi…

    Discourse DiscoTOC