There's a security issue with the way you populate the form action using the current URL, $_SERVER['REQUEST_URI'] needs to be escaped, otherwise an attacker could forge a URL to inject <script> content in the page. Please see a fix here: http://ift.tt/2sgN4gH ...
from Google Alert - vulnerability http://ift.tt/2nMN9E2
via IFTTT
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment