ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
XSS
Viewvc
NVD
GitHub
CVSS 3.1
3.5
EPSS
1.2%