"><img src=x onerror=alert('testing')>
Hello, If I enter alert code or any script into the subject field and after posting my message If I refresh or click on the home page then A popup is showing and says (testing) with an OK button. ...
Forum Discussion
What Claudius said and additonally, it is also very important HOW YOU RENDER your view...are you using out of the box components, custom components or are you rendering the view directly in the frontend via JS (from the API response)? I tested the above and it was not an issue when FreeMarker was used, but when rendering directly from an API response with JS I was able to reproduce it...
(@Claudius there is actually no difference if Admin or not, the subject field of the post is NOT sanitized properly...which is an issue, the XSS is saved to the DB, the same can be done with the API...that should not be possible...)
