📄 Mezzanine CMS 6.1.0 Cross Site Scripting

# Exploit Title: Mezzanine CMS 6.1.0 Stored Cross Site Scripting (XSS)
    via component /blog/blogpost/add
    # Date: 23/07/2025
    # Exploit Author: Kevin Dicks
    # Vendor Homepage: https://github.com/stephenmcd/mezzanine
    # Software Link: https://github.com/stephenmcd/mezzanine
    # Version: 6.1.0
    # Category: Web Application
    # Tested on: Ubuntu Server 20.04.6 LTS (Focal Fossa), Firefox browser
    version 136.0 (64-bit)
    # CVE : CVE-2025-50481
    # Exploit link : https://github.com/kevinpdicks/Mezzanine-CMS-6.1.0-XSS
    
    ## Summary:
    A cross-site scripting (XSS) vulnerability in the component
    /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute
    arbitrary web scripts or HTML via injecting a crafted payload into a
    blog post.
    
    ## Reproduction Steps:
    1. Login to the admin portal.
    2. Create a new blog post.
    3. Insert source code, and enter the following payload:
    ```
    
    <script>alert(document.location)</script>
    
    ```
    4. Save the new blog post.
    5. The blog post is published, and can be accessed by any user.
    6. Stored XSS is executed.
    
    --