GeoNetwork - Reflected Cross-Site Scripting
GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting (XSS) in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing arbitrary JavaScript execution in a victim's browser.
PoC 已收录GeoNetwork
CVSS—