Vue3 Element Admin
Monthly
Cross-site scripting in youlaitech vue3-element-admin through version 3.4.0 allows a remote attacker with high privileges to inject malicious JavaScript via the Notice Handler component (`src/views/system/notice/index.vue`). Successful exploitation requires a privileged account to craft the payload and a separate user interaction to trigger script execution in the victim's browser. A public proof-of-concept exploit exists, though EPSS at 0.04% (14th percentile) and absence from CISA KEV indicate no widespread exploitation; the vendor was unresponsive to coordinated disclosure, leaving no vendor patch available.
Cross-site scripting in youlaitech vue3-element-admin through version 3.4.0 allows a remote attacker with high privileges to inject malicious JavaScript via the Notice Handler component (`src/views/system/notice/index.vue`). Successful exploitation requires a privileged account to craft the payload and a separate user interaction to trigger script execution in the victim's browser. A public proof-of-concept exploit exists, though EPSS at 0.04% (14th percentile) and absence from CISA KEV indicate no widespread exploitation; the vendor was unresponsive to coordinated disclosure, leaving no vendor patch available.