Lucene search

K
packetstormAchuth V PPACKETSTORM:171699
HistoryApr 05, 2023 - 12:00 a.m.

Uptime Kuma 1.19.6 Cross Site Scripting

2023-04-0500:00:00
Achuth V P
packetstormsecurity.com
157
cross site scripting
cve-2023-26777
uptime kuma
remote attacker
arbitrary javascript code
status page
javascript execution

EPSS

0.002

Percentile

60.4%

`# Exploit Title: Stored XSS in uptime-kuma <= v1.19.6  
# CVE: CVE-2023-26777  
# Exploit Author: Achuth V P (retrymp3)  
# Date: February 09, 2023  
# Vendor Homepage: https://github.com/louislam/  
# Software Link: https://github.com/louislam/uptime-kuma  
# Tested on: Ubuntu  
# Version: <= v1.19.6  
# Exploit Description: Stored Cross Site Scripting vulnerability found in Uptime Kuma v.1.19.6 and before, allows a remote attacker to execute arbitrary javascript code via the description, title, footer, and incident creation parameter of the status status page in the application.  
  
Create a status page, while giving the title or the discription give the payload: <script>""</script><script>alert("XSS")</script>  
If anyone loads the page, the javascript inside the script tag will be executed.  
`

EPSS

0.002

Percentile

60.4%

Related for PACKETSTORM:171699