Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.
Advisories for Golang/Github.com/Xhofe/Alist package
2022