Description
The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Larvata Digital Technology | FLYGO | unspecified – ≤ 2021.4e | — |