Lucene search
Asura-nC14395F6-BF0D-4B06-B4D1-B509D8A99B54HistoryNov 21, 2021 - 6:42 a.m.
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
2021-11-2106:42:42
asura-n
www.huntr.dev
12
xss
stored
snipe-it
checkout
vulnerability
stolen cookie
bug bounty
EPSS
0.001
Percentile
21.4%
Description
Cross site scripting vulnerability in checkout page in notes field
Proof of Concept
1.Login to the demo page.
-
Go to accessories , select any product and add payload in the checkout notes
-
click save and open the product xss will trigger
payload = "><img src>
Impact
This vulnerability is capable of stolen the user cookie
Related
osv
osv
snipe-it is vulnerable to Cross-site Scripting
2021-12-03 20:40:50
CVE-2021-4018
2021-12-01 10:15:07
github
github
snipe-it is vulnerable to Cross-site Scripting
2021-12-03 20:40:50
cve
cve
CVE-2021-4018
2021-12-01 10:15:07
prion
prion
Cross site scripting
2021-12-01 10:15:00
cvelist
cvelist
CVE-2021-4018 Cross-site Scripting (XSS) - Stored in snipe/snipe-it
2021-12-01 10:00:11
veracode
veracode
Cross-site Scripting (XSS)
2021-12-02 03:39:47
nvd
nvd
CVE-2021-4018
2021-12-01 10:15:07