漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
OpenReplay HTML Injection vulnerability
Vulnerability Description
OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for example. Email is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that during Registration steps for FullName looks like is validated correct - can not type there, but using this kind of bypass/workaround - bad actors can achieve own goal. As of time of publication, no known fixes or workarounds are available.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
输入验证不恰当
Vulnerability Title
OpenReplay 安全漏洞
Vulnerability Description
OpenReplay是开发人员友好的、自托管的会话重播。 OpenReplay 1.14.0及之前版本版本存在安全漏洞，该漏洞源于缺少对Name field-Account Settings的验证，导致攻击者可以向受害者发送带有HTML注入代码的电子邮件。
CVSS Information
N/A
Vulnerability Type
N/A