logo
DATABASE RESOURCES PRICING ABOUT US

community.realitytvworld.com Cross Site Scripting vulnerability OBB-1222238

Description

Following coordinated and responsible vulnerability disclosure guidelines of the **[ISO 29147](<https://www.iso.org/standard/45170.html>)** standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence. Affected Website:| **[community.realitytvworld.com](<http://community.realitytvworld.com>) ** ---|--- Open Bug Bounty Program:| **Create your bounty program now**. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| **[XSS (Cross Site Scripting)](<https://www.owasp.org/index.php/Cross-site_Scripting_\(XSS\)>)** / CWE-79 CVSSv3 Score:| 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N] Disclosure Standard:| Coordinated Disclosure based on **[ISO 29147](<https://www.iso.org/standard/45170.html>)** guidelines Discovered and Reported by:| **haxmov ** Remediation Guide:| **[OWASP XSS Prevention Cheat Sheet](<https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md>)** Export Vulnerability Data:| Bugzilla Vulnerability Data JIRA Vulnerability Data [ Configuration ] Mantis Vulnerability Data Splunk Vulnerability Data XML Vulnerability Data [ XSD ] Vulnerable URL: ![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAcjElEQVR4nO2df1AU5/3HNyeS4zh+HcfJLxVoijR1kDiUoDWONTRBwtgLJQQJNVQZQxiKhBKHEodSa5ASsClJGOuYDmGcxOlYSh3Goc4lVYYyBAme5EpPigbI5SR4IJgTj+vJfv94vt3Z7D7P7t5xx8/P6y+e5559ns/zeT67D/vs7vt5hKZpCgAAAAA8gGyxDQAAAABWLDDHAAAAAJ4C5hgAAADAU8AcAwAAAHgKmGMAAAAATwFzDAAAAOAplsQcEx0dff36dVISANzIUo6upWwbm0W0c7m4CGBY/Dnm888/n5ub27JlCzYJAG5kKUfXUraNzSLauVxcBLARmWNGRkb8/PywP01PT584cYKUlM6FCxf27t1LSi4L2F5y2Q/zbJczUqJmLJidAiE0MjISFBS0ADYwuBZdAl1wI0vZNjbCds4/ru7cufPSSy8FBwdHRES89tprs7OzEptemiz8AC05aEGGh4eVSqWUnwRKCpOUlHTp0iVScrlgs9nQHy77wQU4bTE2SDFjwewUDqHAwMAFsIHB5ehi+9ZDLGXb2AjbOf+4Sk1NPXDggNlsHhoa2r17d1lZmcSmlywLPEBLDa/FneFu3749ODi4a9cubHIZ8eijjy62CUvChqXMfKLL075dyrax8fQZev/+/cuXL1ssFl9fX4qiampqcnJy3nrrrQVo2nOs8hNT0vOYP/zhD9HR0cHBwT/72c+mp6cpipqeno6KirJarY888sgHH3zATp48edLPz++tt95at25dUFDQyy+//ODBA1LNFy5ceOaZZ9auXctPPnz48Fe/+tW6det8fX1feOGFiYkJiqLu37//yiuvhISErF+//je/+c3Dhw+p/92N1tfXR0dH+/r6vvjiixMTE6+//npISEhwcPDPf/7z+/fvO1uMsZBZz2EfHhQU9NJLLyFXsA/huOW999579tlnmareeOONl19+md19dOCJEydCQkLCwsLef/99iqJmZ2cPHjzo5+e3cePGX//616iPV69e3bZtm4+PT0hIyAsvvPDVV19xPMlZrxM2Y9++fewCL7744ptvvskU2LZt2wcffPD888+jc5uiqOvXrz/66KNMf1955ZXXX39dYCw4PWLz1VdfPfvss35+fps2bfrwww+xUeH2oZcYXRRF3b59+7nnnvPz84uOjq6vr2cPPdZUxNWrV5966ik/P7+IiIif/vSn//73v0lDzy/pLttExws7NPy4QsVI5y/bTn6F7MB78sknXQgqX1/fBw8eoAmGoii73e7t7c1v2hNB4qHrA6yVic8xVqtVr9d3dXX19PSYzeby8nKKogICAoxGo1KptNlsubm57OTzzz9vtVp7enp6e3t7e3v7+vpqa2tJlQs8jKmtrdXpdDqdbnBwMDw8fGBggKKo4uJis9nc19fX3t5+4cKFxsZGtpGdnZ16vd5sNsfFxVkslv7+/u7u7uHh4YqKCqeKCbiiv78fuWJ0dJRfnuMWrVbb0dHxzTffML3LyMjg12k0Gg0GQ1NT044dOyiKOnbs2MzMTH9/f3t7e0dHx6lTpyiK6uvrO3To0NjYmMFgiIyMLCoqErBT1Izs7Gx2gaysrNbWVvTr7du39Xq9VqtNT0/X6XQos62tbW5urr29HSV1Ol1aWprAWHB6xKaoqMjf339gYODixYukOcYTQ09JiC5knre399DQkE6na25uFnAym/T09Ly8vNHR0c7Ozh07dsjlctLQ80u6yzbR8cIODTauBM5fzgnLqZAdeGVlZS4EFadTx48f379/P7bp5Xh9WKUIL6UNDw9TFHXv3j2U7OrqiomJYX7CPo9Bh4yOjqL8lpaWxMRE9Pfo6GhUVBRziNVqVSqVk5OT2KRGo+nr62Mb43A4lErlrVu3UPLChQvJyclMi1NTUyi/s7NTJpPNzMwwNj/22GNOFeP0Cz0z4Liis7MT6wrO4cnJyefPn2fyOSuzqE6mywi1Wm21WtHfer0+KSmJ/jZDQ0OhoaHC7YqawS4wMzPj7++PhqyxsXHv3r00TZvNZoVCgQxOSkoqLS3NyclBNfj7+9tsNoGxYPeI3ZDD4ZDL5ezYwD6PcfvQ0xKiizGPaYUxT/gZw+TkpJeXF3/Nne9zUkm32CY8Xna7HRtsbFBcCZy/HDuxFTL2uBBUdrudXVVVVVVKSorD4eA3jfXS0rw+LOQD2qWJ+H2MUqlk7vXCw8MnJydFD5HL5evXr0d/x8XFjY6OMod3dXUxxS5dupSUlMS8WcROTk9PT05OxsfHs6sdHx+32+3R0dFMzWhckZEBAQHo78jISH9/fx8fH6ZRi8XiVDEproiMjJTiCq1W29bWRlFUW1tbWloaf2VWqVSy3626e/euxWKJiooKCQkJCQnZvXs36uO1a9d+/OMfR0REhISEJCUl2Ww20aalm+Hj45OWlob+62xpacnKyqIoKiwsLDY2tqur6+uvvzabzZWVlTqd7uHDhzqdLiUlZXJyUmAsSG+LjY+PUxTFjg1+GQ8NvWh0oVbm5ubYrfDNC2GBcoKCgjIzM5OTk3/5y1/W19dfuXIF5fN9TirpFtuExwstMfGHBhtXpPOXc8JiK2RwIaiYdTCKov72t781NzefO3duzZo1/KZXzPVhNbCgz/zXrFkTFhbGJEXfWkbhtazJyMhAixJtbW15eXmi5W02m0wm6+3t9fL6/6GRyWQURWm12vz8/FOnTsnlcpPJlJqa6l4zsrKy3n333dzc3J6enpaWFpSZlpam0+lu3bqVnp4eEBCQkJDQ0dGBXdNwO24fendFl16v52d+9NFHn332mcFgMJvNpaWl27dvf+edd7A+x5Z0l20ujJdTceXsq8MuB9W//vWvgoKC9vb24OBggaZXwPVhVSB8m0O6McT+hF0ra21tZe612TgcDrVazdzYcpI0TWs0Gr1ezzmEdC9MMpL+9s2slGL37t2TyWTse17RwwXWrGia3rx5s06nCwwMZOrkO42NUqnkLAKMj497eXkxSb1ezzdJ9FVyjhn8955VKtXbb7+dkZHBZHZ1dSUlJe3du/fixYs0TTc2NhYXF4eGhprNZoljwcnhrJW1traS1srcO/RSoosxb3h4GCUlrpVx0Ov1kZGR6G+BoWdKutE2gfHC9gIbV6Tzl28n1i3sTGeDChWYnJx87LHHPvzwQ3bfOU1jvbQ0rw+wVub6HGO1Wr28vAYHBzlJFKOZmZkmk8lgMCQkJFRVVTE1MIvRHR0dmzdvZvI5SZqmq6urk5KS+vv7TSZTUVFRR0cHTdP5+fl79+4dHR01GAxbt25taGgQNpJ2PoZomk5KSsrPzx8bGxscHNyxY4dTcwzHLTRNV1ZWxsfHp6en852Ajb+CgoLk5GT0r25tbe2xY8domtZoNI2NjVNTU4ODg1qtlgl3Ly8vo9HocDg4VYmawS+Qk5Pj7+//5z//mW2MRqPRaDTIYJPJ5O/vn5CQgH6SMhYcI2ma1mq17NhgfMh+SuH2oZcYXTRNZ2ZmarXa4eFhg8EQHx8v5TIxMDCQmpr6ySefWCyW0dHR/Px8xskcn2NLutc2gfHC9oIfV6Tzl28ntkJOXDkbVA6HIyUlpbi42MaC3zTJS0vw+gBzjOtzDE3TVVVVCoWiqamJnayvr1cqlTU1NRqNJjAwcP/+/cxzM3ZtZWVlFRUVTFWcJE3TDofjyJEjarUavaVjsVhomrZarYcOHVKr1ZGRkVVVVeiy5fYYQh9/KZXKxx9/vKGhwak5hu8WtLrCJIVvemiattlsJSUlkZGRCoUiLS0N/V/W0dGRmJgol8tDQ0NLS0uZpsvLy1Fb/KqEzeAXaG1tVSqVzGAhcnJyMjMzmWRiYiIzTFLGgmMkTdMmk+mZZ55RKpWxsbF1dXVY37p96CVGF03TY2Nj6enpSqUyKiqqpqZGymXCbrdXVVXFxsZ6e3trNJrc3NyxsTGsz7El3WubwHhhe8GPK1SMf/7y7SS5hR1XzgYV8wSFITAwkN80yUtL8PoAc4zIHOMCEn0aGxvb3d1NSq4krFarXC4XeJ9nVZmxKLgWXUajUaPRzKddKT5fLNtIkM7fRTxDV/DFYTWwaN/537hxQyC5krh06dKOHTsWWJhryZqxKLgWXXq9PiYmZj7tSvH5YtnmLIt4hq7gi8NqwJ26yyC7zWd6evrdd99FL26CGZ7DXbH329/+9v33379z586nn35aUVFRUFDgclVu97lrtsFZOU+uX7/+6quvLrYVyxi3zTEgu42FWdQGMzyHG2Nv165djY2NkZGRubm5xcXFHO0fp3C7z12wDc7K+ZOXlxcVFbXYVixnRFfTpqamqqurRYsdP368qKiIk8l5bsZnYR6IiZohpQa2nZOTk3l5eWq1Ojw8/MiRI5zvk+dTv2umirrRZrNlZ2eLunqZPp9EsSdsvEQPrDCwZ6XLSLwUuPFA1ygpKZHL5ejlo3lWZbFYZDIZVjh5/leVVYL4fQyKD9Fiy3FrB+ls3LiR/ZVvXl6e3W7X6/WffPJJV1dXZWXlItomyuzsbGpqqsPhWGxDPIVo7K14D5Bw71kp8VLgxgNdYGJioqGhobu7+/Dhw6Jf5otitVoVCsUqF06eJ+5ZK1u+stvSYeLswYMHfX19p0+fjoiI2LRp08mTJ8+fPz/Pyr28vGJjY9l/uJGxsbGUlJS6ujr3VrtEkBJ7K9sDJFbDWckHzQpbtmxZs2YNzA1LAZE5hi3WvX//fpJSPVt2myTeTlIspyjqd7/7HV9IHCvTjZW4x4qWu6whL6ru7uPj8+WXXzLy40NDQ+Hh4STbHvk2JD9HRER89tln6I9PP/2Uyf/73/8uPEDsAvwtGBAbN2584403BA7kgK0H27svvvjC19f32rVrFEVNTEwEBQX94x//kK63zx9i7C4DwpZzJN+xxmM9IOwEdgGndhAgqeVj49PX1/c73/nO73//e+wmApx9QrGbPmAz+Z4RFb3nbFfB34OAs2EEKSSEBf/5o8lAuj7wLRcwe2JigrPJCONJjlVOjSkD6aqCdS+2U1K2BpBuz7JAZI5hi3W/+eabJKV69i05SbydpFhutVp7/wdbSBwr002SuOeLlrusIe+UuvuNGzfKysrQP8hY25hvlY8cOZKdnY2OCuFBqj8vL+/pp59G0w+Hq1evPv3004wQFnYLBgFINZPqwfYuOjq6oqKipKSEoqjKysq0tLQf/ehHlGSNdP4QY3cZIHUZwY49dzmB5F4pqu8ktXxsfBqNxkuXLjU1NQnbicBu+oDN5HtGQPQeK0fP34OAs2EEqaf8zvIPxMY/6fqAtZxkdnBwMHuTEbb3+EPggpI/6apCci+pU1jmubPA0kX0iQ37USpWqZ4tuy0g3o5VLB8mCImTpIfYsCXuqW9rjM9HQ166urvJZIqJiTl37hy/ZsY2hMFg2LBhA/PBtokHvwaE1Wqtrq5WqVRZWVmMPsfg4GBWVpZKpaqurka7AAyTt2Bg4IvN8GuWUg+nd3a7PS4urqqqSq1Wo+/bh6VppGOHGCsIj+0y0wsm9kSN5w+iU+6VsoMA1lHS41P4U3Pspg+knSA4Z6WA6D1fjp60B4HAWxUCJyP/QGz8k3Y04FtOMpvTFkdQg+JtOSFlTNmVkEZN4GLF75SAHIBrMbb0cW6OqampycvLo2kavfiPMltaWnbv3o3+NpvNcrmcOXZgYAB5cGpqysvLC0k7cCrnlEdfL5vNZm9vbyZ/cHAQRXBfX19KSkp4eLharVapVKQJgGQGG6xJnHaZA7FnV3JyMhJEQmBtQ2zfvr21tZV2lcnJSa1Wy8gXenl5abVaJhz55mHfeMF2gVOzQD0CvUO7TjGukKjJQRri7OxsVFVKSsrZs2dJXUawY0/UCaRL5Dzdy0nyHSU9PgUaQkLx6v+hUqk0Gg02k+8ZkqsFmsvOzk5ISCgtLa2rq7t8+TLWDxJPRlImG9L1AWu56HBg5xgBqVZsJfzukEaN5F5spyRKzgjH2PLCuWf+GRkZFy9epCiqra0Nu1AmzPy1uLVa7c6dOzs6OvR6PbJknrhs0u3bt/v7+3/xi1+I2vbee+/FxMT85Cc/YXKkr5VRFHXz5k0k+Xfs2DGUc+zYsY6OjsLCwps3b7pmPKlmAQQ8PzY2JpPJxsbG5mMMA1ouu3v3bk9PDxNXpC7P/70pt7vX7SGKYDZ90Ov1er2+v79fr9djM1H5eXrmo48+OnPmTHx8vN1uLy0tZcc5g8s9JcX/itTqX5Gdcg7RWYgzwXLkyvkS/STxdqxi+TBZSJx/+ylF4l7UDDZYeXCJ6u4Oh4MtNk6yzWQyxcXFcZYOpK+VFRQUKJXK0tJSZp0NYbFYSkpKlEplQUEB3zwp9zHYmkn1kHpH0/TU1FRoaOi5c+dUKtXAwICoMUyStMKAFYTnd5nmxZ4L9zFucS87SVLLlxifJN14hJK36QMpk39WktbKRMOGZu1WwC4v/WTkZ5LWyrA7GmDXyhblPoY0asJrZZxOubB1CD+5vBCfYzhi3Ry5cr7sNkm8HavFPUzeCAAr042VuMeGtcsa8tLV3TkL1ljbMjIyzp8/zzz5F/U2h9zcXGbC4zM8PJybm8s3T8ocg61ZoB5s72iaLiwsRKumx48f37Vrl6gx7CR2iGmCIDynyzQv9lyYY9ziXk4Sq5YvPT6xuvEI7KYP2Ez+WemU6D1ptwLOpUD6ycjfSIIPaUcDvuULOceMjo6y18dIo0aKZGynnN06hJ9cXkjSXWaLdXPkyvmy21jxdpqgxY08W1tby98IACvTjZW4x4a1yxryEtXd+aOOtc3Zu0bXcPl5jPR6sL3r7e1VKpXoPzubzRYVFdXc3Cz9bMEOMU0QhOfDiT2Xn8eI4tT5T1LL59SJ4lOhUMTExLBPE6xuPAK76QM2k39WOiV6L7BbAftSIP1kpHkbSfAh7WjAt3wh5xibzSaXy5nZkXRxI0UytlPObh3CTy4vHqF510Fh7t+/r1arzWYzeq1706ZNzc3NTz75pDvW7ZYcN27c2Llz59dff73YhgAYVkzsjYyMJCQk3L17110VrhjPLAUOHz5sMBg+/vjjxTZkueK0tj9Hrnxly24vvII6IJ2VHXvzATzjRurq6pg3KQAXcO69smUqEf/f//533759Em9H3KjuDgDAcmft2rU/+MEPFtuKZYxzc8wylYhfu3att7d3WVmZlMJuVHcHAABY5Tg3x8zOzv7lL38RVpqbnp4+ceLE/KzCw5H6Ec1nU1JSgj4VFObKlSvFxcVGo3Hr1q0tLS2HDx/mFHjttdd8fHwEZJcWBY6wFZaFt1xgvDgyXPv27eOXvHLlyhNPPOHr67tt27bPP//cs7ZSFEVRN27c2LNnT0BAwLp16w4ePIhUsEZGRjiic3v27GEftWfPnj/+8Y/sHFKPSGzcuNGND2MAYGnh9rcIXH57Zz41i74WLNGq0NDQ1tbWycnJqqoq9KUOG7SZhF6v53+QvLiIvnayWJaLbrxhs9l27dqVmZnJHx3hsfAEMTEx+fn5ZrPZZDLl5ORkZ2fT/4scGwv2dkFGo1Gj0bBfgRPoEQCsQty51/Ii4i4Rb4fDkZiYGBQUlJiYaLfbOb+yZcPd0tyCsViWi46LgOq+8Fi4ndnZ2eLi4pMnT4aFhUVERJSXl3d2djK/PsqC0XimKKqhoeHQoUM+Pj5MzurcRwAAiIjOQjab7cCBA0qlcsOGDZWVlcz76XV1dVFRUYGBgTk5OYy409TUFFMz5114h8NRXl6u0WgUCkVmZqbA+++kTPa9iMFgUKlUzIecTD7fWpTPuY9pb2/HdhZ9YVpYWBgfH28wGNg/sfc7ampqErCwurparVaHhoaeOXOG9No724cKhSIrK8tisZSVlSHpp7y8PLbyIxb2q/rV1dXs75A4fuZYjnWvdMulG8+ugWQtdnRExwLbBbd4FWG3248cObJ//35Up0KhKC4u1mg0Go2mpKSECaqpqSmVSsV8OyLaIwBYhYjfx2DFw0na2nwdbwantLtJWtmI6enpjIyMmpqap556Soq1fEii7kgToqmpqb29/fvf/z77J7ZsOHodgCSWzpEQJyFRypsk7iR9DwWO5ST3SrdcuvEMUrZa4CAwFqQuzN+rFEX99a9/VSgUPT09p0+fRjkzMzNKpdJgMHR1del0urfffhvlnzlzJj09fd26dVK6AwCrFNFZiC8ePixNW5uDdO1uUXmltLS0wsJCbIskqXOOVVhRdyQCODY2tmvXrtTUVJqmh4aGGCFbdiXCYukcCXHSfQwlTcobK+7kwh4KbNklrAaURMulG892l/BWC/yYER4LYf+77FXEzMwM0mI5deoUTdM2m627u5v5tbW1lQmqmJgYvV7vsqoCAKwGROYYrHi4RC0HNk5pdwtLkVdUVMhksj/96U/8FgWkzrFWcUTdmauz2WxWq9XV1dXd3d0JCQn8hiSKpfNzOGtlAj4Ufobvwh4KTHNS9NKFLZRoPNtdwlst8FsXHgsXxOr5SWEuXry4detWfr7RaERtMeL5MMcAgAAi3/kz4uFeXv9fUiaTufwAdv4PnGdmZlpaWs6dO1dUVJSRkREQECBqLamqmzdvVlZWMqLud+7cmZycfOKJJyiKCgsLa2pq0mq1vb29oqtGnoav/H/nzh3hQ5bdKwkcFmAs+F41m816vZ752i4mJsZsNmOPnZuboyiqoaGhtLTUXfYAwEpFZI4JCwtTKBTMCY8YGRlxtpmAgACVSnX9+vUtW7aw8zUajbe39xdffBEdHU1RlNFojIqKwmai8jKZrKWl5Xvf+15zc/PRo0ffeecdUWuxvPrqq2fPnj106NDg4GBwcDBFUSqVysvL6z//+c93v/tdiqKee+65AwcOnD592mAw8A8XsJCDSqWamZn55ptv0NcSJpNJgre+BVbHQqPRUBT15Zdfrl+/nqKowcFBlE/yswvGz99yUWtJiI6FdP+T4Ht1bm5u+/bt4+Pj6NudwcHBDRs2UBT18ccfl5WVXbt2DRUbGBhAbV2+fLm/v18mk83Nzd27dw9NWqLTPwCsOkTvdPji4cIrEmwdb1EhfZogiy0qRW40GuVyeX9/PycfK3VO0/TQ0BDbSKyoe2Fh4fbt2w0Gg8ViaWpqQm9YHT16lN1TpiEpYukID0l5O7uHArs5Ub10AculG88uRrIWWyEtYSycEquX6NX09PTs7GyTyaTX6x9//PHGxkaapqemptRqdWVlpcVi6evr27x5M2qLeZDT3d3t7+/PeagDa2UAgJD07jJHPFxURB3peNfX14sK6dOuvrtM03RxcfHOnTs5+Vipc5qmz58/Hx8fL9rT8vLyqKgouVy+devWs2fP3rp1S6FQMNMhuyEpFiI8JOXtwh4KzLGieukClks3nvTuMttabIW0hLFwSqxeolfHx8ezs7MDAwMjIyOPHz/O5KNlOqVSGRMTU1tbyzkKnscAgABOa/svR2ZnZ+Pi4o4ePXrw4MHFtgUAAGAVsSrmGIqi/vnPf/7whz9cbCsAAABWF6tljgEAAAAWnhWiVwYAAAAsQWCOAQAAADwFzDEAAACAp4A5BgAAAPAUMMcAAAAAngLmGAAAAMBTwBwDAAAAeAqYYwAAAABPAXMMAAAA4ClgjgEAAAA8BcwxAAAAgKeAOQYAAADwFDDHAAAAAJ4C5hgAAADAU8AcAwAAAHgKmGMAAAAATwFzDAAAAOApYI4BAAAAPAXMMQAAAICngDkGAAAA8BQwxwAAAACeAuYYAAAAwFP8H0AjDNKq0myCAAAAAElFTkSuQmCC) --- **Mirror:** [Click here to view the mirror](<http://1222238.openbounty.org/mirror/>) ### Coordinated Disclosure Timeline Vulnerability Reported:| 12 July, 2020 01:46 GMT ---|--- Vulnerability Verified:| 13 July, 2020 09:15 GMT Website Operator Notified:| 13 July, 2020 09:15 GMT a. Using the ISO 29147 guidelines| ![](/images/done.png) ---|--- b. Using publicly available security contacts| ![](/images/done.png) c. Using Open Bug Bounty notification framework| ![](/images/done.png) d. Using security contacts provided by the researcher| ![](/images/done.png) Public Report Published [without any technical details]:| 13 July, 2020 09:15 GMT Vulnerability Fixed:| 14 July, 2020 02:20 GMT ---|---