Igniter07

**Name of the Vulnerable Software and Affected Versions** Password Pusher versions v1.41.1 through v1.48.0 **Description** A cross-site scripting (XSS) vulnerability was identified in the Password Pusher application. The issue arises from an un-sanitized parameter which could allow attackers to inject malicious JavaScript into the application. Users who self-host and have the login system enabled are affected. Exploitation of this vulnerability could expose user data, access to user sessions, or take unintended actions on behalf of users. To exploit this vulnerability, an attacker would need to convince a user to click a malicious account confirmation link. **Recommendations** Update to version v1.48.1 or later where input sanitization has been applied to the account confirmation process. If updating is not immediately possible, consider restricting access to the application until the update can be applied.