Chillzhuang

**Name of the Vulnerable Software and Affected Versions** SpringBlade version 4.8.0 **Description** A stored cross-site scripting (XSS) issue exists in the '/api/blade-desk/notice/submit' endpoint. This allows attackers to execute arbitrary web scripts or HTML by injecting crafted input into the `content` parameter. Stored XSS occurs when the application receives data from a user and includes that data within its later HTTP responses in a way that allows attacker-supplied data to be executed as code in the browser. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `content` parameter in the '/api/blade-desk/notice/submit' endpoint until the issue is resolved.