Description

Evil users can attack other users or administrator users through this vulnerability, causing other users/administrator user accounts to be taken over

Proof of Concept

step 1. Create new tag

Step 2: Enter XSS payload <img src=x onerror=alert(localStorage.getItem('_a_lui_')) /> to Description tag

Step 3: Go to http://127.0.0.1/questions

Step 4: Click to tag

POC

https://drive.google.com/file/d/1TJAaoAe0YT4GadLntvCYBuyj1ZlFL4Yp/view

Impact

Executing JavaScript in victim's session which leads to potential account takeover, perform actions as that user, ...