Openakita
Monthly
Stored cross-site scripting in OpenAkita's File Upload API (/api/upload) allows remote attackers to inject persistent malicious scripts by manipulating file-related arguments, affecting all versions through 1.27.12. The Notion-hosted proof-of-concept confirms this is a storage-type XSS, meaning the payload persists server-side and executes in victims' browsers upon subsequent access to the affected content. A public exploit exists and the vendor did not respond to responsible disclosure, leaving no official patch; exploitation is constrained by high attack complexity (AC:H) and required user interaction (UI:P), reflected in the low CVSS 4.0 score of 2.3.
Stored cross-site scripting in OpenAkita's File Upload API (/api/upload) allows remote attackers to inject persistent malicious scripts by manipulating file-related arguments, affecting all versions through 1.27.12. The Notion-hosted proof-of-concept confirms this is a storage-type XSS, meaning the payload persists server-side and executes in victims' browsers upon subsequent access to the affected content. A public exploit exists and the vendor did not respond to responsible disclosure, leaving no official patch; exploitation is constrained by high attack complexity (AC:H) and required user interaction (UI:P), reflected in the low CVSS 4.0 score of 2.3.