Lucene search
Inweol0A5EC24C-343E-4CC4-B27B-2BEB19A1C35FHistoryJan 27, 2022 - 5:04 a.m.
Cross-site Scripting (XSS) - Stored in microweber/microweber
2022-01-2705:04:46
inweol
www.huntr.dev
8
0.001 Low
EPSS
Percentile
21.6%
Description
Stored XSS occurs when changing a user’s profile
Proof of Concept
XSS POC : "><something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(document.domain)</something:script>
1. Open the https://demo.microweber.org/demo/admin
2. Go to "Users" > "Edit profile"
3. Change the value of "First Name" to XSS PoC
4. Refresh
Impact
Through this vulnerability, an attacker is capable to execute malicious scripts.
Related
cnvd
cnvd
microweber cross-site scripting vulnerability (CNVD-2022-12763)
2022-02-14 00:00:00
osv
osv
Cross-site Scripting in microweber
2022-02-09 00:00:31
CVE-2022-0506
2022-02-08 09:15:08
prion
prion
Cross site scripting
2022-02-08 09:15:00
cvelist
cvelist
CVE-2022-0506 Cross-site Scripting (XSS) - Stored in microweber/microweber
2022-02-08 08:55:10
nvd
nvd
CVE-2022-0506
2022-02-08 09:15:08
github
github
Cross-site Scripting in microweber
2022-02-09 00:00:31
cve
cve
CVE-2022-0506
2022-02-08 09:15:08
veracode
veracode
Cross-Site Scripting (XSS)
2022-02-09 07:59:15