Steedos Platform
Monthly
Reflected cross-site scripting in Steedos Platform (all versions through 3.0.15-beta.47) lets an attacker inject JavaScript into the anonymous /api/page/render endpoint by abusing the schemaApi or data query parameters, which are written unescaped into inline script elements. Because the endpoint requires no authentication, a crafted link is enough: when a logged-in Steedos user opens it, the attacker's script runs in the victim's browser context and can read and exfiltrate the X-Auth-Token session credential, enabling full account takeover of that session. No public exploit code or active exploitation has been observed at time of analysis, though the vulnerable source files and route are publicly linked in the advisory references.
Reflected cross-site scripting in Steedos Platform (all versions through 3.0.15-beta.47) lets an attacker inject JavaScript into the anonymous /api/page/render endpoint by abusing the schemaApi or data query parameters, which are written unescaped into inline script elements. Because the endpoint requires no authentication, a crafted link is enough: when a logged-in Steedos user opens it, the attacker's script runs in the victim's browser context and can read and exfiltrate the X-Auth-Token session credential, enabling full account takeover of that session. No public exploit code or active exploitation has been observed at time of analysis, though the vulnerable source files and route are publicly linked in the advisory references.