Description
Location Aware Sensor System by Linkit ONE, up to commit f06bd20 (2023-04-26), contains a reflected cross-site scripting vulnerability in the PM25.php file that allows remote attackers to execute arbitrary JavaScript by injecting malicious code into GET parameters. Attackers can craft a malicious URL containing unencoded payloads in the site, city, district, channel, or apikey parameters to execute scripts in victims' browsers when they visit the page.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
LinkItONEDevGroup Location Aware Sensor System (LASS)
Default version status: unknown
0 to ≤ f06bd202f37f2a8fafe932feabcb119a292f016eaffected
pkg:github/LinkItONEDevGroup/LASS