1. EmpCloud API Exposes Critical XSS Vulnerability: Announcements Endpoint Stores Raw Script Tags
A critical security flaw in EmpCloud's API allows attackers to inject and store malicious JavaScript code directly into the platform's announcement system. The vulnerability, a classic Cross-Site Scripting (XSS) issue, was discovered in the `POST /api/v1/announcements` endpoint. During testing, raw HTML and JavaScript ...