Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
lazysizes 跨站脚本漏洞
Vulnerability Description
lazysizes是一款轻量级惰性加载器。它主要用于图像，iframe和脚本等内容的延迟加载。 lazysizes 5.2.0及之前版本中存在安全漏洞，该漏洞源于程序没有清理以下属性：data-vimeo、data-vimeoparams、data-youtube和data-ytparams。攻击者可利用该漏洞执行恶意JavaScript代码。
CVSS Information
N/A
Vulnerability Type
N/A