CVE-2026-28274
中文标题:
（暂无数据）
英文标题:
Initiative Vulnerable to Token Theft via Stored XSS in Document Uploads
漏洞描述
中文描述:
（暂无数据）
英文描述:
Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives" section can upload a malicious `.html` or `.htm` file as a document. Because the uploaded HTML file is served under the application's origin without proper sandboxing, the embedded JavaScript executes in the context of the application. As a result, authentication tokens, session cookies, or other sensitive data can be exfiltrated to an attacker-controlled server. Additionally, since the uploaded file is hosted under the application's domain, simply sharing the direct file link may result in execution of the malicious script when accessed. Version 0.32.4 fixes the issue.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Morelitea | initiative | < 0.32.4 | - | - |
cpe:2.3:a:morelitea:initiative:<_0.32.4:*:*:*:*:*:*:*
|
| morelitea | initiative | * | - | - |
cpe:2.3:a:morelitea:initiative:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2026-28274 |
2026-02-27 03:19:47 | 2026-02-26 22:00:01 |
| NVD | nvd_CVE-2026-28274 |
2026-02-27 02:00:05 | 2026-02-26 22:00:03 |
版本与语言
安全公告
变更历史
查看详细变更
- affected_products_count: 1 -> 2
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']