cinevisages.fr Cross Site Scripting vulnerability

2019-12-0410:52:00

MrRain_1996

www.openbugbounty.org

JSON

Security Researcher MrRain_1996 Helped patch 907 vulnerabilities
Received 4 Coordinated Disclosure badges
Received 9 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affectingcinevisages.fr website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website:	cinevisages.fr
Open Bug Bounty Program:	Create your bounty program now. It’s open and free.
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	**MrRain_1996 Helped patch 907 vulnerabilities
Received 4 Coordinated Disclosure badges
Received 9 recommendations **
Remediation Guide:	OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAQoElEQVR4nO2df0xT1xfAn1hqKeVXKRUKyo9tSAhxhDDUDTczjSOMkeoQMoYTf8Qfi0Nm0Dl0jrENjQJxaAhbsgUN2ZbFGEYW50w1S0O6BZDVrmHQMFZrfTIsv7SygqXv+8f95uXt/bgtxQfMnM9fvbfnnnPPuZceel/feYsoiiIAAAAAQAQC5nsCAAAAwBML5BgAAABALCDHAAAAAGIBOQYAAAAQC8gxAAAAgFhAjgEAAADEYuHmmMTExJs3bwo1gXkBVgEAgBmxQHPM77//7vF4nn32Wd4mMC/AKgAAMFO85Jhbt26FhITwvjU+Pn7ixAmh5ixpa2vLz88Xas4XmGjMu7bZ8+677wYFBZ0/f15IYF5WYTZR8mPs6Ojo9u3bo6KiYmNj33vvvUePHvln2j/mZUucPXs2MTExODh41apV165dm2PrwJMPhcVqtSoUCl/ewkj6QVZW1tWrV4Wa84jL5Vqw2maDw+EICAgwGo1ut1tIZl5WYTb7yo+x+fn5xcXFdru9t7c3Ozv7yJEj/pn2j8f7R+QLDQ0NSUlJ169fdzgcFy9eVKlU7e3tczkB4IlnIeYYkiTDw8OnpqZ4m4AYeF2++VqFucwxExMTcXFxTqcTNTs6Op5++mn/TPvH3OcYjUZz/fp1utnU1JSXlzeXEwCeeHy6HvPZZ58lJiZGRkZu3bp1fHycIIjx8fGEhASn07lo0aLz588zm/X19SEhIadPn166dGlERMS2bdv++ecfpKezs3Pt2rUhISGxsbGvv/76H3/8wWuura1t48aNgYGBrOamTZtOnz6NOm/evLlkyRI0GYIg9uzZc+jQIbzAM888gx/Omsb09PT777+/dOnS4ODgLVu2DA8PM48y0Ou6urrExMSIiIg333yT1jY5Oblz586QkJD4+PgPP/xwenqaIIiioqJPP/2UVr5mzRoUKLqHNzidnZ1r1qwJCgqKiorasmXLnTt3kPDdu3dfffXVkJCQxMTEurq6iIgIjGmvkR8eHmYt34kTJ6KiomJiYr788kvuoghp47XO6wKKHssKN+D0DLk7kAnSxrvleMcKyQcFBd2+fTs4OBgN7O/v12g0Qv5iQj1Lf/HOYvjpp58wy83dgU1NTSRJZmdn0507duw4d+6c7xYBwCvec4zT6TQajQaDoaOjgyTJI0eOEAQRFhbW29urUChcLldJSQmzuWnTJqfT2dHR0dXV1dXV1d3dferUKaQqLy+vtLTUZrO1t7dnZ2fLZDJei0IXY/Ly8nQ6Her84YcfPB7PlStXUFOn0+Xm5uIFtFotfjhrGqdOndLpdDqdzmKxaDSanp4ebmRMJhOKjM1mq6ysRP3V1dUTExMmk+nKlSt6vb6pqYkgiMLCwtbWViRw9+5do9G4ceNGpjbe4HR3d+/evXtwcNBsNsfFxe3fvx8J79+/XyqV9vf363S6Cxcu0Ep4TXuNfGRkJGv5ent7zWZzc3Mz/QHEXBQhbbzWhVzgWhEKOO8O5K4F75YTGiskT9PX11dRUVFbWyvkr1CoZ+kvxtkoDvRbnZ2d69evLy0txSwQdweuW7dOJpPR/8wRBBEYGBgfH88NLwD4D/5rjtVqJQji/v37qGkwGJKSkui3eM/K0BCbzYb6L126lJmZSVHUyMiIRCLhvQJhs9kSEhLQa6fTqVAoRkZGuE2SJOVyOdKQlZV18ODB4uJiZDE0NHRqagovYLPZ8MNZs1Kr1d3d3axo0C6zItPe3k5HRqVS0ectRqMxKyuLoqiJiQk0B4qiGhsb8/PzmdowwaHp7++Pjo6mKMrtdstksoGBATrC4eHhGNO+KGctHx1/7ipgtPFa53WB1wo34BR2B7JkuFtOaKyQPI3dbk9KSvr2228x/np11g9/8c7aOVAUZbFYCgsLlUplTU0Nmo/QhPE7sKKiQqVSqVQqbngBYDZIvCYhhUJBH+loNJqRkRGvQ2Qy2bJly9DrlJQUm81GEERERERBQcHq1atffvlljUaTmZn50ksv0WoNBgN6ffXq1aysLPrwh9mMiYlJTk42GAypqakkSR4/fjw5OXl6elqn023YsCEwMBAvsGzZMvxwpgvj4+MjIyMrV670MTJxcXEoMqOjow6HIyEhAfV7PB6JREIQRFBQUG5ubmtr6zvvvHPp0iX6X06EUHB+++23w4cP9/T0TE1NeTwej8dDEMTQ0JDH40lMTKQjjF4ImcZEXsgvOv7cVRDSJmSd1wWuFUzAfdmBvFsOM1ZIHlFQUFBeXl5UVCTkr5Czs/cX42xsbCzX8dTU1Ly8vIGBgbCwMNQjtEDcHSiRSNxuNxp17Nix8vJyu92ek5PDtQIAfuM9xzxGvvnmmxs3bpjNZpIkDx48+Pzzz589e5YgiMWLF8fExCAZ/K+Wc3NzdTrdwMBAXl5eWFhYenq6Xq9nnnThBbwOZ7F48eKZ+uhyuQICArq6uugPnYCA/x9IFhYWnjt3rqSkpKOj49KlS6zPSt7gaLXaXbt2NTU1yWQyr3//GNNCkfcR1irwahOyPiMX/Aj4Y+fu3bsmk+mXX36he7j+VlZWCoVaPH+Zh2OIe/fuVVdX19bWvv3229XV1U899ZTQhNFys3agx+NxuVyPHj0KDAwMCwsLCwsbGhqSy+W+TwkAvIP/msM9EKOPZXw8K2ttbWUdRCCMRmNcXByr0+12q1Qq+hSI1aQoymAwZGVl5efnX758maKoxsbGsrKy6OhokiR9EfA6nIlarTYajULRwERGoVBwz3woinK5XEql8syZM5s3b+Zq4AZnaGhIIpEwO5EJdFZmtVpRP/OsTMg0Vzmrk7l8rFlxV0FIG9e6kAu8vnMDzpVkxpnZybvlhMbit6jb7RZylukvb6hn6S/eWd6zMoqiHA5HeXm5QqHYu3cvZsIUZwdSFKXRaH7++WdauLa2NicnR8h3APAD/3OM0+mUSCQWi4XVRH/ABQUFdrvdbDanp6dXVVVRFNXT05OTk4N+iW+z2Xbt2sX8lSQ6Ptbr9WlpaXQnq4lQq9VqtRrJ2+320NDQ9PR03wXw7zJPsWtqarKyskwmk91u379/v16v9zHH7N27d/Xq1ei/yFOnTlVXV9NixcXFoaGh3333HUuDUHDUanVjY+PY2JjFYtFqtbSJgoICrVZrtVrNZvPKlSvxpoWUM53F5BjWKmDWkdc6rwu8n7ncgOPjTM9faMvhcwxXnncbCPkrtMqz8deXhCqE1WotKSnBLxD17x1IMe6PGRoaamlpUSqVBoPBR4sA4Av+5xiKoqqqquRyeXNzM7NZV1enUChOnjypVqvDw8PfeuutiYkJiqKmpqaqqqqSk5OlUqlarS4pKRkcHGRZqaioqKyspPWzmoji4uKCggK6mZmZyZLBC2DeZTnrdrsPHz6sUqlkMplWq3U4HD7mGJfLVV5eHhcXJ5fLc3Nzmf8Ut7a2KhQKFBCmBqHg6PX6zMxMmUwWHR198OBB2sTg4GBeXp5CoUhISDh58iTeNK9yzNdQ1qchaxUw68hrndcF3s9cbsAxceauBXfL4cdy5blLifFXaJVn4+9scowvC0T9ewciGhoaEhISpFJpRkYG814ZAHgsLKIo6vEevt26dSstLe3Bgwd+jF2xYsWFCxdWrVrF2wR46evre/HFF//++2+R9C/8VZjplpvNFgUAYEbM6TV/r/T19WGaAC9GozEpKUk8/bAKAAD4zQKtu/xf5+bNm/v27RNP/8cff/zFF19s3rz5xx9/rKys3Lt3r3i2AAAA/AZyjCiUlpbSN0+Iwbp16z7//PPvv/++qKiorKxs27Zt4tkCAADwm/9Gjrl16xbrrsCFBvPRBsPDwyaTqby8nH53cnLyjTfeYFYnGx0d3bp1a2RkJKuGvFA/4sGDBzExMX19fWvXrr1x40ZXV1dwcPCBAwfE929BEx8fP6OLKzOVBwDAb/4bOWbhMzY2VlNTg147nU65XL5kyRLUnJyczMnJoW+oRuzYscPj8ZhMJp1Op9fr6bFC/YiGhoaSkpIVK1agplKpdDqd4joGAAAwGx77L9XEqE/u34845xL8z5o/+eQTZqfL5ZJIJGNjY6jZ3t6empqK6Ufcv38/LS2NLmbFNQQAALDQ8P495uHDh3v27ImKilq2bNlHH300PT2NKWs/Iz2oX6h8/Z07d1555ZWQkJAVK1Z8/fXXGM1Cpdp5C6rzToPpUXBwcFFR0fDw8KFDh6KioiIjI7dv3/7w4UOMIdaTDljTi4+PP3r0KLPH5XJ5PB6pVIqaMplsYmIC0484d+5cRUUF5jmJdGl3AACABYL3HFNWVkaSZHd395UrV9ra2hobGwnhsvYz1UNgy9eHhob29PRcvnyZmWN4K5xjSruzCqoLTQPVVG9vbzcajSRJpqSkOBwOk8n066+/Wq1W2kFeQ6wnHXgNRVhYWEZGRmVl5aNHjx48eFBVVZWZmYnpJwji4cOH9fX11dXVsbGxR48epTM0k9LS0vXr19+4ccPrBAAAAOYI/Ncct9utUCjoe5jb2tpWr16NKWtPCd/SzNXDNccqX8+svk6flXGrNuFLuzMLqgtNA0kyD6kCAgLoe6ENBgN6HiKmJjzmrIy3s6enJz09XSqVohKE9DOMhfpra2vRreD9/f1paWkNDQ1cnU6ns6amRqlUFhYW0jV+AAAA5hEvOYYkSalUSjctFkt0dDS+4gXvJyyvHvS6u7t7w4YNGo1GpVIplUqkiiRJmUxGy/f09GCux1itVpawWq3mnYnQNLx6RFcE4TVEzTzHIMbGxurr67k1Q7n9ycnJdG5ra2vjrfmIGBkZ0Wq1zMqMAAAA88X83+c/o1roBF+F866uLtFmJy5yufzMmTPcp9uy+kdHRwcGBujnnSQnJ5Mkyavwzz//PH78uF6vr66uFm/aAAAAPuIlx6jVaqlU+tdff6EnYvX29vp3a6GQnnv37pEk+cEHHyAxh8NByxMEcfv2bfTBarFYaFVGo5Gl3O12u1wupvDy5ctFcsdHQz7S3NysUqlee+01fL9cLvd4PMxp89rdt29fS0vL7t27LRZLZGTkbCYGAADwePD6TWfXrl35+fk2m81sNmdkZDQ0NPhyVub6N263m6sHyQuVr9dqtczq6/izMsKH0u5C7nAlMWdlvIaofz/pwGazMY/UmGFh9rjd7qSkpLa2NpYkb79Wq83JybFarSaTKTU19auvvqIoqr+/nznPkpIS+qEyAAAACwHvOcbpdO7evVulUsXFxVVVVbndbq+fyNxM1tTUxNWD5IXK19vt9o0bNyoUiuTk5NraWnyO8aW0u5A7XElMjsHUhKefdOByuWQyGeuqO3cyFy5cyMjI4LrD2+9wOIqLi5VK5fLly0+ePIk6L168uHLlSqGwAAAAzDuPv7b/3DNnpdp9N3TgwAGz2Xzt2jXxJjM5OZmSknLs2LGdO3eKZwUAAGA2zP81/yeS2tpa7nWjx8uSJUtaWlpeeOEFUa0AAADMBqhXJgqBgYHPPfec2FYgwQAAsMCBHAMAAACIxZNwPQYAAABYmMD3GAAAAEAsIMcAAAAAYgE5BgAAABALyDEAAACAWECOAQAAAMQCcgwAAAAgFpBjAAAAALGAHAMAAACIBeQYAAAAQCwgxwAAAABiATkGAAAAEAvIMQAAAIBYQI4BAAAAxAJyDAAAACAWkGMAAAAAsfgfarKKfvyd9O8AAAAASUVORK5CYII=)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAQoElEQVR4nO2df0xT1xfAn1hqKeVXKRUKyo9tSAhxhDDUDTczjSOMkeoQMoYTf8Qfi0Nm0Dl0jrENjQJxaAhbsgUN2ZbFGEYW50w1S0O6BZDVrmHQMFZrfTIsv7SygqXv+8f95uXt/bgtxQfMnM9fvbfnnnPPuZceel/feYsoiiIAAAAAQAQC5nsCAAAAwBML5BgAAABALCDHAAAAAGIBOQYAAAAQC8gxAAAAgFhAjgEAAADEYuHmmMTExJs3bwo1gXkBVgEAgBmxQHPM77//7vF4nn32Wd4mMC/AKgAAMFO85Jhbt26FhITwvjU+Pn7ixAmh5ixpa2vLz88Xas4XmGjMu7bZ8+677wYFBZ0/f15IYF5WYTZR8mPs6Ojo9u3bo6KiYmNj33vvvUePHvln2j/mZUucPXs2MTExODh41apV165dm2PrwJMPhcVqtSoUCl/ewkj6QVZW1tWrV4Wa84jL5Vqw2maDw+EICAgwGo1ut1tIZl5WYTb7yo+x+fn5xcXFdru9t7c3Ozv7yJEj/pn2j8f7R+QLDQ0NSUlJ169fdzgcFy9eVKlU7e3tczkB4IlnIeYYkiTDw8OnpqZ4m4AYeF2++VqFucwxExMTcXFxTqcTNTs6Op5++mn/TPvH3OcYjUZz/fp1utnU1JSXlzeXEwCeeHy6HvPZZ58lJiZGRkZu3bp1fHycIIjx8fGEhASn07lo0aLz588zm/X19SEhIadPn166dGlERMS2bdv++ecfpKezs3Pt2rUhISGxsbGvv/76H3/8wWuura1t48aNgYGBrOamTZtOnz6NOm/evLlkyRI0GYIg9uzZc+jQIbzAM888gx/Omsb09PT777+/dOnS4ODgLVu2DA8PM48y0Ou6urrExMSIiIg333yT1jY5Oblz586QkJD4+PgPP/xwenqaIIiioqJPP/2UVr5mzRoUKLqHNzidnZ1r1qwJCgqKiorasmXLnTt3kPDdu3dfffXVkJCQxMTEurq6iIgIjGmvkR8eHmYt34kTJ6KiomJiYr788kvuoghp47XO6wKKHssKN+D0DLk7kAnSxrvleMcKyQcFBd2+fTs4OBgN7O/v12g0Qv5iQj1Lf/HOYvjpp58wy83dgU1NTSRJZmdn0507duw4d+6c7xYBwCvec4zT6TQajQaDoaOjgyTJI0eOEAQRFhbW29urUChcLldJSQmzuWnTJqfT2dHR0dXV1dXV1d3dferUKaQqLy+vtLTUZrO1t7dnZ2fLZDJei0IXY/Ly8nQ6Her84YcfPB7PlStXUFOn0+Xm5uIFtFotfjhrGqdOndLpdDqdzmKxaDSanp4ebmRMJhOKjM1mq6ysRP3V1dUTExMmk+nKlSt6vb6pqYkgiMLCwtbWViRw9+5do9G4ceNGpjbe4HR3d+/evXtwcNBsNsfFxe3fvx8J79+/XyqV9vf363S6Cxcu0Ep4TXuNfGRkJGv5ent7zWZzc3Mz/QHEXBQhbbzWhVzgWhEKOO8O5K4F75YTGiskT9PX11dRUVFbWyvkr1CoZ+kvxtkoDvRbnZ2d69evLy0txSwQdweuW7dOJpPR/8wRBBEYGBgfH88NLwD4D/5rjtVqJQji/v37qGkwGJKSkui3eM/K0BCbzYb6L126lJmZSVHUyMiIRCLhvQJhs9kSEhLQa6fTqVAoRkZGuE2SJOVyOdKQlZV18ODB4uJiZDE0NHRqagovYLPZ8MNZs1Kr1d3d3axo0C6zItPe3k5HRqVS0ectRqMxKyuLoqiJiQk0B4qiGhsb8/PzmdowwaHp7++Pjo6mKMrtdstksoGBATrC4eHhGNO+KGctHx1/7ipgtPFa53WB1wo34BR2B7JkuFtOaKyQPI3dbk9KSvr2228x/np11g9/8c7aOVAUZbFYCgsLlUplTU0Nmo/QhPE7sKKiQqVSqVQqbngBYDZIvCYhhUJBH+loNJqRkRGvQ2Qy2bJly9DrlJQUm81GEERERERBQcHq1atffvlljUaTmZn50ksv0WoNBgN6ffXq1aysLPrwh9mMiYlJTk42GAypqakkSR4/fjw5OXl6elqn023YsCEwMBAvsGzZMvxwpgvj4+MjIyMrV670MTJxcXEoMqOjow6HIyEhAfV7PB6JREIQRFBQUG5ubmtr6zvvvHPp0iX6X06EUHB+++23w4cP9/T0TE1NeTwej8dDEMTQ0JDH40lMTKQjjF4ImcZEXsgvOv7cVRDSJmSd1wWuFUzAfdmBvFsOM1ZIHlFQUFBeXl5UVCTkr5Czs/cX42xsbCzX8dTU1Ly8vIGBgbCwMNQjtEDcHSiRSNxuNxp17Nix8vJyu92ek5PDtQIAfuM9xzxGvvnmmxs3bpjNZpIkDx48+Pzzz589e5YgiMWLF8fExCAZ/K+Wc3NzdTrdwMBAXl5eWFhYenq6Xq9nnnThBbwOZ7F48eKZ+uhyuQICArq6uugPnYCA/x9IFhYWnjt3rqSkpKOj49KlS6zPSt7gaLXaXbt2NTU1yWQyr3//GNNCkfcR1irwahOyPiMX/Aj4Y+fu3bsmk+mXX36he7j+VlZWCoVaPH+Zh2OIe/fuVVdX19bWvv3229XV1U899ZTQhNFys3agx+NxuVyPHj0KDAwMCwsLCwsbGhqSy+W+TwkAvIP/msM9EKOPZXw8K2ttbWUdRCCMRmNcXByr0+12q1Qq+hSI1aQoymAwZGVl5efnX758maKoxsbGsrKy6OhokiR9EfA6nIlarTYajULRwERGoVBwz3woinK5XEql8syZM5s3b+Zq4AZnaGhIIpEwO5EJdFZmtVpRP/OsTMg0Vzmrk7l8rFlxV0FIG9e6kAu8vnMDzpVkxpnZybvlhMbit6jb7RZylukvb6hn6S/eWd6zMoqiHA5HeXm5QqHYu3cvZsIUZwdSFKXRaH7++WdauLa2NicnR8h3APAD/3OM0+mUSCQWi4XVRH/ABQUFdrvdbDanp6dXVVVRFNXT05OTk4N+iW+z2Xbt2sX8lSQ6Ptbr9WlpaXQnq4lQq9VqtRrJ2+320NDQ9PR03wXw7zJPsWtqarKyskwmk91u379/v16v9zHH7N27d/Xq1ei/yFOnTlVXV9NixcXFoaGh3333HUuDUHDUanVjY+PY2JjFYtFqtbSJgoICrVZrtVrNZvPKlSvxpoWUM53F5BjWKmDWkdc6rwu8n7ncgOPjTM9faMvhcwxXnncbCPkrtMqz8deXhCqE1WotKSnBLxD17x1IMe6PGRoaamlpUSqVBoPBR4sA4Av+5xiKoqqqquRyeXNzM7NZV1enUChOnjypVqvDw8PfeuutiYkJiqKmpqaqqqqSk5OlUqlarS4pKRkcHGRZqaioqKyspPWzmoji4uKCggK6mZmZyZLBC2DeZTnrdrsPHz6sUqlkMplWq3U4HD7mGJfLVV5eHhcXJ5fLc3Nzmf8Ut7a2KhQKFBCmBqHg6PX6zMxMmUwWHR198OBB2sTg4GBeXp5CoUhISDh58iTeNK9yzNdQ1qchaxUw68hrndcF3s9cbsAxceauBXfL4cdy5blLifFXaJVn4+9scowvC0T9ewciGhoaEhISpFJpRkYG814ZAHgsLKIo6vEevt26dSstLe3Bgwd+jF2xYsWFCxdWrVrF2wR46evre/HFF//++2+R9C/8VZjplpvNFgUAYEbM6TV/r/T19WGaAC9GozEpKUk8/bAKAAD4zQKtu/xf5+bNm/v27RNP/8cff/zFF19s3rz5xx9/rKys3Lt3r3i2AAAA/AZyjCiUlpbSN0+Iwbp16z7//PPvv/++qKiorKxs27Zt4tkCAADwm/9Gjrl16xbrrsCFBvPRBsPDwyaTqby8nH53cnLyjTfeYFYnGx0d3bp1a2RkJKuGvFA/4sGDBzExMX19fWvXrr1x40ZXV1dwcPCBAwfE929BEx8fP6OLKzOVBwDAb/4bOWbhMzY2VlNTg147nU65XL5kyRLUnJyczMnJoW+oRuzYscPj8ZhMJp1Op9fr6bFC/YiGhoaSkpIVK1agplKpdDqd4joGAAAwGx77L9XEqE/u34845xL8z5o/+eQTZqfL5ZJIJGNjY6jZ3t6empqK6Ufcv38/LS2NLmbFNQQAALDQ8P495uHDh3v27ImKilq2bNlHH300PT2NKWs/Iz2oX6h8/Z07d1555ZWQkJAVK1Z8/fXXGM1Cpdp5C6rzToPpUXBwcFFR0fDw8KFDh6KioiIjI7dv3/7w4UOMIdaTDljTi4+PP3r0KLPH5XJ5PB6pVIqaMplsYmIC0484d+5cRUUF5jmJdGl3AACABYL3HFNWVkaSZHd395UrV9ra2hobGwnhsvYz1UNgy9eHhob29PRcvnyZmWN4K5xjSruzCqoLTQPVVG9vbzcajSRJpqSkOBwOk8n066+/Wq1W2kFeQ6wnHXgNRVhYWEZGRmVl5aNHjx48eFBVVZWZmYnpJwji4cOH9fX11dXVsbGxR48epTM0k9LS0vXr19+4ccPrBAAAAOYI/Ncct9utUCjoe5jb2tpWr16NKWtPCd/SzNXDNccqX8+svk6flXGrNuFLuzMLqgtNA0kyD6kCAgLoe6ENBgN6HiKmJjzmrIy3s6enJz09XSqVohKE9DOMhfpra2vRreD9/f1paWkNDQ1cnU6ns6amRqlUFhYW0jV+AAAA5hEvOYYkSalUSjctFkt0dDS+4gXvJyyvHvS6u7t7w4YNGo1GpVIplUqkiiRJmUxGy/f09GCux1itVpawWq3mnYnQNLx6RFcE4TVEzTzHIMbGxurr67k1Q7n9ycnJdG5ra2vjrfmIGBkZ0Wq1zMqMAAAA88X83+c/o1roBF+F866uLtFmJy5yufzMmTPcp9uy+kdHRwcGBujnnSQnJ5Mkyavwzz//PH78uF6vr66uFm/aAAAAPuIlx6jVaqlU+tdff6EnYvX29vp3a6GQnnv37pEk+cEHHyAxh8NByxMEcfv2bfTBarFYaFVGo5Gl3O12u1wupvDy5ctFcsdHQz7S3NysUqlee+01fL9cLvd4PMxp89rdt29fS0vL7t27LRZLZGTkbCYGAADwePD6TWfXrl35+fk2m81sNmdkZDQ0NPhyVub6N263m6sHyQuVr9dqtczq6/izMsKH0u5C7nAlMWdlvIaofz/pwGazMY/UmGFh9rjd7qSkpLa2NpYkb79Wq83JybFarSaTKTU19auvvqIoqr+/nznPkpIS+qEyAAAACwHvOcbpdO7evVulUsXFxVVVVbndbq+fyNxM1tTUxNWD5IXK19vt9o0bNyoUiuTk5NraWnyO8aW0u5A7XElMjsHUhKefdOByuWQyGeuqO3cyFy5cyMjI4LrD2+9wOIqLi5VK5fLly0+ePIk6L168uHLlSqGwAAAAzDuPv7b/3DNnpdp9N3TgwAGz2Xzt2jXxJjM5OZmSknLs2LGdO3eKZwUAAGA2zP81/yeS2tpa7nWjx8uSJUtaWlpeeOEFUa0AAADMBqhXJgqBgYHPPfec2FYgwQAAsMCBHAMAAACIxZNwPQYAAABYmMD3GAAAAEAsIMcAAAAAYgE5BgAAABALyDEAAACAWECOAQAAAMQCcgwAAAAgFpBjAAAAALGAHAMAAACIBeQYAAAAQCwgxwAAAABiATkGAAAAEAvIMQAAAIBYQI4BAAAAxAJyDAAAACAWkGMAAAAAsfgfarKKfvyd9O8AAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAScElEQVR4nO2dfUxT1xvHr12FUksRqVVelIIbGkMY2wjBDZEZo6ZrSIfIjGNiNqLGdIwRZxA3xtTh21xmxwgzzjizMLIoIYQ4tnRuYYQYZIiMYUdIFVZrx7CjWDtkwP39cfK7ubkvp/cWbovz+fzVnnvuOc95znN6es9pv2ceSZIEAAAAAEiALNgGAAAAAP9ZYI4BAAAApALmGAAAAEAqYI4BAAAApALmGAAAAEAqYI4BAAAApALmGAAAAEAqYI4BAAAApELQHPPpp5+uWLEiNDT0mWee+fbbb6W2KQAMDg6Gh4f7kdntdh89enQWKxVlyQx5++23w8LCvvzyS4nKHxwcjIyMpKd89913ERER9+7do1JeeOGFgwcPEgRx//79t956Kz4+PiwsbOXKlcePH5+amkJ5MJf8syoAHuarhUpnZJitoJIaum2z7slABj8QNEhfmM1mnU5nsViGh4fr6uoWLVrU2trq8645zu3bt1UqlfD84+Pj/t3os9KZFCiKkZERmUzW3d09OTkpURW3b99euHAhI1Gv1xcXF6PXDQ0NMTExHo+HJMm8vDyj0Wi1WoeHhy0WS3Z2dkdHB8qGueSfVQHwMKYWFDzsDLMSVFJDt23W7ZzLDQdmC99zTExMzJUrV6i3n3zyicFgkNKkQOB3cD+6c0wAKuKcY6xWq1KptNlsk5OTSUlJ58+fJ0nS6/XK5fLR0VF2IZhLflsV3DnGZ4a5/FELcwwwQ3yslbndbofDkZmZSaVkZWX19fUR/3/OPXXqVEJCQmRk5Kuvvup2uxm3f/bZZ5s2baLeHjx4sLCwkCCIBw8e7N69e/HixcuWLfvggw+mpqbYKwnUqgu6dPTo0cWLF0dHR3/xxRdUtpdffvnkyZPo9Y0bN0JDQykbdu/e/c477xAE8fDhwzfeeCM8PDw+Pv7999+nr7ocP358yZIlkZGRhYWF//zzD0q8du3a2rVrw8PDY2Njt2zZcvPmTco2t9ut0+k8Hs+8efPQihOmcFGcPn06ISEhKirqtddeo5pw7dq1NWvWhIWFLV68eOvWrXfu3CEI4pVXXvnwww+pG9esWSPEknv37tEtZ/uf4FrMQV2A7+g7d+5s2rQpPDx85cqVdXV17KatXLly165dZWVlZ86cUavVKACmp6cJgpDL5ez8mEsUnE7AhBA9ka8tnA7kjD3OfkGwI8rnGhojqPiGDCdTU1MHDhxYsmTJggULtm7ditYkMZ178uRJhnn46tgBT/DEqpCBwOc3zmHI2Qr/gh8IMvgpyG63KxQKesrAwIBGoyFJ8vbt2wRB7Nixw+Fw9Pf3Z2Zm7t27l/P2sbEx9DY5ObmxsZEkyddff91gMAwNDfX29j777LNms5nxjYb+jZiqyOl0trS0WK1WKtvZs2c3btyIXh85ckQul9fX16O3iYmJ6PGrvLx827ZtNputr68vOzu7urqaKjMvL29oaGhgYCA5ObmyshLdqNVqz54963K5bDbbxx9/bLPZ6LZZrVaVSjU+Po5WnDgL54PvOYYgiJ07dzocjoGBgfXr1+/Zswddqq2tPXfu3OjoqNPpLCkpMRqNJElevHgxLS0NZXA4HAqFAn3l92kJ3XK2/9nmUV2A72ij0Uh3I/s5hiRJl8ul0WgWLlzY3t5OJebk5BgMhra2NrR0RgdzCcHpBIz99G/ifG3BxAkj9jj7hS+iqNrZ5nEGFd+Q4aSqqiotLa2np8dutxcXF6NFbL7O5TTPZ3V02zCxKmQgsP2GGYacrfA7+IEg4mOOYX8s2mw2+kcPFZ1tbW2JiYnsEjIyMi5evEgVhYJVpVLZbDaUoampKSMjw+cc43K52IU7HA6lUonWtdPT00tLS7dv345uUavVExMTJElqNBrqo6q7uzs9PZ0qc2hoCKU3NDSg2HW5XHK5nFooZzuBYSdn4cKdyXZje3s7pxsHBgaWLl1KkqTX61Wr1cjympqanJwcgZZQtXP6n20eY47h7OjJyUmFQkF3I+ccQ5Lktm3bli9fTk8ZGxsrKytLSkqSy+VPPvlkZWUltVGEuYTgdILwOYazLZg44Yw9BNUvfBElZI5hXGIPGb7atVptV1cXPQXTuZzm+awO4z16rIoaCJTf+Kzia4XfwQ8EEdyKBEEQcrl8cnKSnjI9PU2tY6hUKmodIC4uzuVysUswGo3Nzc1btmxpbm7W6/WhoaF3796dmJhISEhAGVatWoVCDYNKpWKvexAEER0dnZSU1N7evnr1aofDUVFRkZSUNDU1ZbFYNmzYMH/+/L///ntkZESn07GNVygUy5Yto2wYGhoiCCIyMjIvLy8jI2P9+vUxMTFpaWnr1q3jswpTuCjoboyJiaHceP369f379/f19U1MTExPT6NFpLCwML1e39jY+OabbzY0NOzcuVOsJcPDw374n7Ojh4eHCYKgu5Hz9l9//bWlpSUuLu7zzz/fvXs3SkRrUEePHn348GFXV1dpaenk5OThw4fxlxCcThAIZ1swDmTHHme/EDwR5QfsIcOZze12u1yulJQUeiKmc/nME1gdgjNWBYYfp984reJrxcyDHwg8PjoDfa/5999/58+fj1LGxsbUarXwCnJzc9F2TnNzs6jPAoHo9XqLxWKz2QwGQ0RERGpqamtrq8Vi0ev1BEGMj4/LZLLOzk4q7GQyH1tQX3/99S+//NLb2+twOEpLS59//vl9+/Zx5vSjcFEYjcaioqLa2lqFQmG32zdv3ozS8/Pzq6urCwoKOjo6GhoaAmDJDCkuLi4tLc3KysrLy8vPz2d8ZIeGhq5Zs8ZsNhcUFNAnEvwlthNmgigH8vXLbCFqyDzxxBOBrI4Tgd6bFb89csEP+OiMiIiImJiYtrY2KqWtrW316tXCK3jqqae0Wu0PP/xw9epV9Lmv1WpDQkJu3bqFMlitVp1Ot2jRIq/Xe//+fZRot9sFlm8wGCwWS1NTU05ODkEQRqOxsbHxp59+QnVFR0crlUqXyxX7f6Kjo9GN4+Pjf/zxB3rd39+/fPlyqsznnnuusLDwwIED586da2xs5KsaU/jM+euvvxwOx3vvvbdixYrY2FiFQkFd0uv13d3dFy5c2LBhA/pSKcoSTv8TBOFHF2i1WoIg6G5k57l06ZLNZtu3b9+6desyMzMrKipQ+oMHD+jZ0CKqz0sYJ/gdQoQYB2L6BRNRomAPGU4iIiIWLVp048YNeiJf52LME1gdBiHe4/Mbp1WYVsww+IEg4HM1jfp/zMjISH19PfX/GMwOCoOKioqUlBT6L56LiopycnIYG3rp6elFRUVOpxNtxtL3Y/A/cNRqtVqtFq0j2+12tVqdmppKXd2zZ09GRgZ6Ljlx4sShQ4dI2hao3W7v7e1NTU1Fm419fX2bN2++cuXKyMjI0NBQUVGRwWCgG+DxeORyeX9/P6ZwPoT8dpnuRq1WW1NTMzo62t/fbzQa6e7dvn27Wq3+5ptv8M3kq4jT/yRPF+A7Gu35U25kxIDX69XpdF999RV629/fr1Qqe3p6rFarVqs9c+aMw+EYHR1tbW1NTk6uqqoiSRJziQHbCZz2j42NyeVyq9WKdq352sIXJ+wu4+wXvoiiSqCbwSiZEVQk15DhpKqqKj09He35m0wmNDA5O5fPPJ/V0W0T6z2ffsNYxReipF/BDwQR33MMSZJmszkxMTEkJCQ1NfXy5csoUfgc093dTRAE+mMEwuPx7Nq1S6PRxMXFUTu66JcqKpVq9erVZrNZ+Byzffv2vLw86m1aWlp5eTn1dnx8vKSkJC4uTqlU6vV6tJGIyjxx4oRWq124cOGOHTu8Xi9JkhMTE5WVlUlJSSEhIVqttqCgwOl0MgyorKxUKpWoOZjC2XaKnWNaW1vT0tIUCsXSpUtLS0vp7m1sbFSpVMhmTDP5KuL0P8nTBfiOttvtGzduVKlUSUlJH330ESMGDh06xNiALSkpyc7OJkny8uXL2dnZarVaqVSmpKScOXOGyoO5RIftBL4QKisrQ12GaYvwruTsF76IopdAmcEumR5UJGvI8EXU5OTk/v37NRqNQqEwGo0jIyMkT+eiEo4dO8Ywj7M6BpRtYr3n0298TuNrBcKP4AeCyDySJKV+VHrw4IFGo3E4HJz79v89BgcHk5OTqUUbABALY8jMPKLwJTxuIxQIJIHYHPv+++8zMzMfq/Cllo8BwA/YQ0bSiHoMRygQMCSfY9xud3V1dX5+vtQVzR1UKhXmlwIAgIc9ZCSNqMdwhAKBRPI5hlpplbqiuUNUVNSKFSuCbQXwqMIeMpJG1GM4QoFA4mOOoastCRHiZud5+PDhpUuX8H/sEg6nCFXAECtFPjg4OI/F6dOn/ZY0l1qcf3bhlLWfRTl3Pkl8SeXoA8DsDhlEfHw832aMFNUBAIWI55j4+PiRkRHpTJn7+OEB9CdWOiaTyT9P3rt3z2w2X716taCgQOy9QUHqgBkdHa2qqhKeDgBA4BEnugBfdvzwAOctfpTj8XiUSuXTTz8t9sYgAgEDAI85Ip5jGEsfeFV/giB+++23qKion3/+mZHOKfGNKdOnejzBf1gAW8ycwKq44xsl1gMCPcmQjuc0jyHOz9nkW7duLViw4Pr16yh/ZGTkjz/+SK+XU8hdlM4/HZ8HK4hdp7p79+5LL70UHh6ekJBw6tQpqkZOh3DKzvOl+yFHj4kfUeL5+BMTOMsHgP8Sfu75ezyenp6e9vb2jo6OoaGh8vJyRga3252bm3vs2LG1a9cyLnV1de3atcvpdPb29sbFxZlMJnyZJpNJrVb39fVdvnyZb44pLi52OBxdXV0tLS1NTU01NTWowI6Ojs7Ozs7Ozq6urhMnTqDMhw4d8nq9PT09LS0tra2ttbW1AhslygMC8Xg8Vqu1t7f3/PnzSDaK07yoqChKZR2tlbGbnJCQUF5eXlJSQhBERUWFXq9/8cUX6XUZjcbW1lZqXb6pqSk3N5fTdUJAKj7odXNz8/T0dEtLC3pL6cWJwmQyhYSEDAwMWCyWCxcuUOmcDomIiGA4BMFO93g83d3dqKccDkdZWRmmWDp88cPnMb78fIjNDwCPJPi/aHIqkGME0qk8er2efZwMG4Y0OrtMIerxfIcFEDxi5hgVd/xRBUI8wMhPEISGhslkYpfDkI7nEyqn9wWf+PnExMSqVasqKys1Go3T6WSbxBBy93q9onT+6fg8WIFT1h7zl3WFQkFZQu9oIQ5huH3mcvRiZed9avszPImJTwD4L+GnCDZe1f/gwYMtLS1nz57lvJdPGp2zTCHq8XxK4Jyy4XgVd59HFQj0AIVSqURCHdRbdjn0ZSiBQuV8TZ4/f351dfWGDRvMZvOSJUvYNzKE3EdHR8Xq/FP4PFhBYDlUi6anp+mWoBczV273W45elOw8X34Ms3UWAADMZWb/oAWv19vQ0FBfX28ymXJzcyMiIhgZpJZGxxNgJXCZTBYbGys8/8zNczqdMpnM6XRyXp3doxbwByvMChL1FwjCA0BgmP1xJZPJGhoatm7dmp6e/u677zKuYqTRORGiHs+nBM4pGz7HlcAFmsfXZLfbvW/fvrq6utra2ps3b7JvZAi5z1DnH3+wgii0Wq1MJhscHKQsEeUQsQgpVqzsPGd+jCdn6ywAAJjT4JfSOHXR8eci008pVygUPT09jDL5pNH5ysSrxyPYSuAY2XAhKu6cOxBCPMCZX2A5GPPYmTnFz/fu3Zufn0+S5JEjR5C8MRuGkLsonX82mIMVOGXtGRL3dPLy8tAZ7729vSkpKT5149mS+Ox0v+XoxcrOY/LznZjAlx9zuDIAPHL41vZn66ILnGNIkiwuLs7KymIUiJFG5ywTrx6PYCuBY8TMhai4B3GO4RMqZ2RmN7mzs1OlUqFt5PHxcZ1Od+HCBXbtDCF3UTr/bDAHK/DJ2tNf03E6nQaDQaVS6XS6Y8eOCdGNZ0jis9P9lqPHxI9Y8XzMiQns/D5PsgCAR4tAaPsHBRDY5+OREHL//fffs7Ky/vzzz2AZIDZ+pM4PAI8osM/52PFICLl3d3cnJiYG2woAAGbK7P+uDJjLICH3bdu2BdsQDg4fPhwTE5OTk2Oz2crLyysqKoJtEQAAMwWeYx4v5rKQe3Z2dk1NTVxcXEFBQXFxcWFhYbAtAgBgpvxn92MAAACAoAPPMQAAAIBUwBwDAAAASAXMMQAAAIBUwBwDAAAASAXMMQAAAIBUwBwDAAAASAXMMQAAAIBUwBwDAAAASAXMMQAAAIBUwBwDAAAASAXMMQAAAIBUwBwDAAAASAXMMQAAAIBUwBwDAAAASAXMMQAAAIBU/A/nBwZE9o4FQAAAAABJRU5ErkJggg==)

Screenshot: cinevisages.fr vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported:	4 December, 2019 10:52 GMT
Vulnerability Verified:	4 December, 2019 11:01 GMT
Website Operator Notified:	4 December, 2019 11:01 GMT
a. Using the ISO 29147 guidelines
—	—
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]:	4 December, 2019 11:01 GMT
Vulnerability Fixed:	25 January, 2020 03:10 GMT
—	—
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability.	3 January, 2020 10:52 GMT
—	—

JSON