Altium Live
Monthly
Stored XSS in Altium Live's Support Center AddComment endpoint allows attackers to inject malicious JavaScript that persists and executes when support staff or other users view affected support cases. The vulnerability stems from inadequate server-side input validation that bypasses client-side HTML escaping, enabling attackers to compromise elevated-privilege support accounts through victim browser execution. No patch is currently available.
Altium Forum has stored XSS in forum posts with scope change (CVSS 9.0). Authenticated attackers can inject JavaScript that executes in other users' sessions, including accessing Altium design tools and project data.
Stored XSS in Altium Live user profile fields allows authenticated attackers to inject malicious scripts that execute when other users view the compromised profile, potentially enabling session hijacking or phishing attacks. The vulnerability stems from inadequate server-side input validation that fails to properly sanitize whitespace-based attribute injection techniques. Exploitation requires a valid user account and victim interaction but carries high risk due to cross-site impact affecting other platform users.
Stored XSS in Altium Live's Support Center AddComment endpoint allows attackers to inject malicious JavaScript that persists and executes when support staff or other users view affected support cases. The vulnerability stems from inadequate server-side input validation that bypasses client-side HTML escaping, enabling attackers to compromise elevated-privilege support accounts through victim browser execution. No patch is currently available.
Altium Forum has stored XSS in forum posts with scope change (CVSS 9.0). Authenticated attackers can inject JavaScript that executes in other users' sessions, including accessing Altium design tools and project data.
Stored XSS in Altium Live user profile fields allows authenticated attackers to inject malicious scripts that execute when other users view the compromised profile, potentially enabling session hijacking or phishing attacks. The vulnerability stems from inadequate server-side input validation that fails to properly sanitize whitespace-based attribute injection techniques. Exploitation requires a valid user account and victim interaction but carries high risk due to cross-site impact affecting other platform users.