Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Stored-XSS reported #427(title section) Ƴ (content section) ƴ(title section) I found another stored-XSS in 404page(name field),the Vulnerability source in monstra-3.0.4/plugins/box/pages/pages.admin.php.
Affected Version:
3.0.4 or before
Payload: <a href="javascript:alert(/xss/)">xss</a>
<a href="javascript:alert(/xss/)">xss</a>
Steps to replicate:
Impacts: A user with editor level privileges can make JavaScript code execution in admin's session.
Testing Environment: PHP/5.5.38 + Apache/2.4.23
The text was updated successfully, but these errors were encountered:
No branches or pull requests
Stored-XSS reported #427(title section) Ƴ (content section) ƴ(title section)
I found another stored-XSS in 404page(name field),the Vulnerability source in monstra-3.0.4/plugins/box/pages/pages.admin.php.
Affected Version:
Payload:
<a href="javascript:alert(/xss/)">xss</a>Steps to replicate:
Impacts:
A user with editor level privileges can make JavaScript code execution in admin's session.
Testing Environment:
PHP/5.5.38 + Apache/2.4.23
The text was updated successfully, but these errors were encountered: