CVE-2018-25056
LOWyolapi - Cross-Site Scripting in render_description Function
Title source: llmDescription
A vulnerability, which was classified as problematic, was found in yolapi. Affected is the function render_description of the file yolapi/pypi/metadata.py. The manipulation of the argument text leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a0fe129055a99f429133a5c40cb13b44611ff796. It is recommended to apply a patch to fix this issue. VDB-216966 is the identifier assigned to this vulnerability.
References (3)
Core 3
Core References
Third Party Advisory vdb-entry
technical-description
https://vuldb.com/?id.216966
Third Party Advisory signature
permissions-required
https://vuldb.com/?ctiid.216966
Patch, Third Party Advisory patch
https://github.com/yola/yolapi/commit/a0fe129055a99f429133a5c40cb13b44611ff796
Scores
CVSS v3
3.5
EPSS
0.0049
EPSS Percentile
39.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
yola/yolapi
Published
Dec 28, 2022
Tracked Since
Feb 18, 2026