Description

Reflected XSS with filter bypass on /editor_tools/module using type= parameter.

Proof of Concept

https://demo.microweber.org/demo/editor_tools/module?type="&gt;</div>&lt;script&gt;alert("xss")&lt;/script&gt;

The value of the “type” parameter is injected into the source code of the page at line 38. Since the value of the “type” parameter is not sanitized, it is possible to close the div tag with ’ "></div> ’ and then put javascript code.