x/vulndb: potential Go vuln in github.com/studygolang/studygolang: CVE-2021-4273

[GoVulnBot]

CVE-2021-4273 references github.com/studygolang/studygolang, which may be a Go module.

Description:
A vulnerability classified as problematic was found in studygolang. This vulnerability affects the function Search of the file http/controller/search.go. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 97ba556d42fa89dfaa7737e9cd3a8ddaf670bb23. It is recommended to apply a patch to fix this issue. VDB-216478 is the identifier assigned to this vulnerability.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2021-4273
• JSON: https://github.com/CVEProject/cvelist/tree/73eb43fb609cd1bfecd5fd441b0aacd29ee5782e/2021/4xxx/CVE-2021-4273.json
• fix: fix: 搜索异常时导致页面渲染异常, 搜索框 XSS 漏洞 studygolang/studygolang#158
• fix: studygolang/studygolang@97ba556
• web: https://vuldb.com/?id.216478
• Imported by: https://pkg.go.dev/github.com/studygolang/studygolang?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/studygolang/studygolang
    packages:
      - package: studygolang
description: |
    A vulnerability classified as problematic was found in studygolang. This vulnerability affects the function Search of the file http/controller/search.go. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 97ba556d42fa89dfaa7737e9cd3a8ddaf670bb23. It is recommended to apply a patch to fix this issue. VDB-216478 is the identifier assigned to this vulnerability.
cves:
  - CVE-2021-4273
references:
  - fix: https://github.com/studygolang/studygolang/pull/158
  - fix: https://github.com/studygolang/studygolang/commit/97ba556d42fa89dfaa7737e9cd3a8ddaf670bb23
  - web: https://vuldb.com/?id.216478

[gopherbot]

Change https://go.dev/cl/459035 mentions this issue: data/excluded: batch add GO-2022-1182, GO-2022-1181, GO-2022-1179, GO-2022-1173, GO-2022-1172, GO-2022-1171

[gopherbot]

Change https://go.dev/cl/592835 mentions this issue: data/reports: unexclude 50 reports