Professional 1.6.36
Summary: PortSwigger released Burp Suite Professional 1.6.36 on 27 January 2016, adding a new scan check for client-side template injection. The check targets applications that place user input inside AngularJS client-side templates, where a long history of sandbox escapes allows arbitrary JavaScript execution through template expressions.
Bottom line: AngularJS sandbox escapes let attackers achieve XSS with minimal syntax that input filters typically don't block, so echoing user input into client-side templates can turn a filtered field into an execution path.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026