GHSA-7gqm-qqf6-8wxq: ntopng Cross-Site Scripting in Login Page via RTL Override

ntopng is ntop's open source network traffic monitoring tool. Its login page at /lua/login.lua writes the referer parameter into the HTML without encoding it. A Unicode right-to-left override character (U+202E) followed by a quote and closing bracket breaks out of the attribute, and an image tag with an error handler runs the attacker's script.

Anyone who opens the crafted login link runs the script before signing in, which exposes them to session hijacking, phishing pages on the ntopng origin and page defacement. The advisory rates it High. Fixed in the releases after 7.1.260923 and 7.0.260921.