CVE-2018-16474

The tianma-static module up to version 1.0.4 has a stored XSS vulnerability that lets attackers inject and execute malicious JavaScript code, which persists and affects all users who view the compromised content.

A stored cross-site scripting (XSS) vulnerability in tianma-static ≤1.0.4 allows attackers to inject arbitrary JavaScript that is permanently saved and executed in the browsers of users accessing the affected content. The vulnerability requires the ability to submit data that is stored and later rendered without proper sanitization.