Grandnode2
Monthly
Stored cross-site scripting in GrandNode 2 through 2.3.0 lets a back-office operator with product-editing rights (store manager or vendor) plant script inside a product description that Grand.Web later renders unencoded through Html.Raw in Product.Layout.Simple.cshtml, so the payload executes in the browser of any other user who opens that product page. Because the CVSS vector carries PR:H, anonymous or unprivileged attackers cannot inject the payload themselves; the practical exposure is confined to deployments with multiple partially trusted operators, such as multi-vendor marketplaces, and execution still requires a victim to view the compromised page. A vendor fix is available in 2.4.0-beta and 2.4.0 (commit 41a8e349eab8d9641cf6ea800d738f2d8991ca22), no public exploit code has been identified at time of analysis, and this is best treated as a genuine but low-to-moderate priority flaw rather than an urgent threat.
Stored cross-site scripting in GrandNode 2 through 2.3.0 lets a back-office operator with product-editing rights (store manager or vendor) plant script inside a product description that Grand.Web later renders unencoded through Html.Raw in Product.Layout.Simple.cshtml, so the payload executes in the browser of any other user who opens that product page. Because the CVSS vector carries PR:H, anonymous or unprivileged attackers cannot inject the payload themselves; the practical exposure is confined to deployments with multiple partially trusted operators, such as multi-vendor marketplaces, and execution still requires a victim to view the compromised page. A vendor fix is available in 2.4.0-beta and 2.4.0 (commit 41a8e349eab8d9641cf6ea800d738f2d8991ca22), no public exploit code has been identified at time of analysis, and this is best treated as a genuine but low-to-moderate priority flaw rather than an urgent threat.