Description mojoPortalv2.7.0.0的FileDialog.aspx组件中反映的跨站点脚本(XSS)漏洞允许攻击者通过注入ed和tbi参数的特制负载执行任意web脚本或HTML。
Related VulnerabilitiesmojoPortal imagehandler存在任意文件读取漏洞PoCCVE-2023-24322: mojoPortal 2.7.0.0 - Cross-Site ScriptingPoCCVE-2023-44012: mojoPortal v.2.7.0.0 - Cross-Site ScriptingPoCCVE-2025-28367: mojoPortal <=2.9.0.1 - Directory TraversalMojoPortal /api/BetterImageGallery/imagehandler 文件读取漏洞(CVE-2025-28367)