Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Lxml 跨站脚本漏洞
Vulnerability Description
Lxml是Lxml个人开发者的一个可与Python交互用于定位Html中元素的软件。 lxml 4.6.2 存在跨站脚本漏洞，该漏洞源于HTML5的formaction属性。
CVSS Information
N/A
Vulnerability Type
N/A