Postybirb Plus
Monthly
Cross-site scripting in the PostyBirb Plus submission description editor affects versions through 3.1.75. Crafted description markup loaded through the editor's defaultValue or overwriteDescriptionValue paths can execute in the Electron renderer, but exploitation requires an authenticated local user of the desktop app and user interaction, and impact is limited to integrity with no confidentiality or availability loss. Version 3.1.76 fixes the issue by sanitizing those loaded values; a public PoC reference exists, but it is not verified as working exploit code.
Cross-site scripting in the PostyBirb Plus submission description editor affects versions through 3.1.75. Crafted description markup loaded through the editor's defaultValue or overwriteDescriptionValue paths can execute in the Electron renderer, but exploitation requires an authenticated local user of the desktop app and user interaction, and impact is limited to integrity with no confidentiality or availability loss. Version 3.1.76 fixes the issue by sanitizing those loaded values; a public PoC reference exists, but it is not verified as working exploit code.