Summary

There is a cross-site scripting vulnerability on To-Do that affected title field.

Details

XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. Payload can we use click or click

PoC

1. Create a new project and name it anything such as "test"
2. Click team and Add a new user who could be our victim
3. Create a new To-Do, Add To-Do and inject click on title of To-Do
4. Go to project overview and click the "click" text
5. XSS will pop up on attacker side and victim side

Impact

Allows attacker to steal victim cookie