Open Audit · Open-Audit Professional · CVE-2018-8978
**Name of the Vulnerable Software and Affected Versions**
Open-AudIT Professional version 2.1
**Description**
The issue is related to a crafted src attribute of an `IMG` element within a URI, which can lead to XSS.
**Recommendations**
For Open-AudIT Professional version 2.1, consider validating and sanitizing all user-inputted data, especially for the `src` attribute of `IMG` elements, to prevent XSS attacks. As a temporary workaround, restrict the ability to input custom `src` attributes for `IMG` elements until a patch is available.