XSS on Hoosk v1.8

[nhienit2010]

This vulnerability in edit page function

Exploit with using "heading" attribute, we can custom HTML tag lead to inject img tag with onerror event, and use HTML encoding to bypass filter some special chars

PoC