Prismatic < 2.8 - Cross-Site Scripting
The plugin does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
PoC 已收录prismatic
CVSS6.1EPSS 1.7%