CVE-Disclosures

CVE Disclosures This repository contains security advisories and vulnerability disclosures researched and reported by Sahil Arya. List of CVEs CVE-2025-70336 — PodcastGenerator 3.2.9 Stored XSS Live Items...

PodcastGenerator 3.2.9 Cross Site Scripting

PodcastGenerator version 3.2.9 contains a persistent cross site scripting vulnerability in the Live Items functionality. Exploit Title: PodcastGenerator 3.2.9 - Stored XSS Date: 2026-08-08 Exploit Author: Sahil Arya Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator Software...

PodcastGenerator 3.2.9 - Stored XSS

Exploit Title: PodcastGenerator 3.2.9 - Stored XSS Date: 2026-08-08 Exploit Author: Sahil Arya Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator Software Link: https://github.com/PodcastGenerator/PodcastGenerator Version: 3.2.9 Tested on: Windows 11 / XAMPP CVE : CVE-2025-7033...

CVE-2025-70336

A Stored cross-site scripting XSS vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTML via the 'TITLE', 'SHORT DESCRIPTION' and 'LONG DESCRIPTION' parameters. The saved payload gets executed on 'View All Live Items' and 'Live...

CVE-2025-70336

A Stored cross-site scripting XSS vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTML via the 'TITLE', 'SHORT DESCRIPTION' and 'LONG DESCRIPTION' parameters. The saved payload gets executed on 'View All Live Items' and 'Live...

CVE-2025-70336

PodcastGenerator version 3.2.9 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability within the 'Create New Live Item' functionality. An authenticated administrator can inject malicious JavaScript or HTML through the 'TITLE' , 'SHORT DESCRIPTION' , and 'LONG DESCRIPTION' parameters. ...

CVE-2025-70336

A Stored cross-site scripting XSS vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTML via the 'TITLE', 'SHORT DESCRIPTION' and 'LONG DESCRIPTION' parameters. The saved payload gets executed on 'View All Live Items' and 'Live...

CVE-2025-70336: Improper Neutralization of Input During Web Page Generation

A Stored cross-site scripting XSS vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTML via the 'TITLE', 'SHORT DESCRIPTION' and 'LONG DESCRIPTION' parameters. The saved payload gets executed on 'View All Live Items' and 'Live...

CVE-2025-70336

A Stored cross-site scripting XSS vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTML via the 'TITLE', 'SHORT DESCRIPTION' and 'LONG DESCRIPTION' parameters. The saved payload gets executed on 'View All Live Items' and 'Live...

CVE-2023-53918

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible through the episodes upload interface episodesupload.php. Malicious JavaScript payloads injected into episode titles execute when administrators view the episodes list page...

CVE-2023-53919

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface themefreebox.php. Malicious JavaScript payloads injected into the Freebox content execute when users visit the application's home page...

EUVD-2023-60212

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface themefreebox.php. Malicious JavaScript payloads injected into the Freebox content execute when users visit the application's home page...

CVE-2023-53918

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible through the episodes upload interface episodesupload.php. Malicious JavaScript payloads injected into episode titles execute when administrators view the episodes list page...

CVE-2023-53919

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface themefreebox.php. Malicious JavaScript payloads injected into the Freebox content execute when users visit the application's home page...

CVE-2023-53919 PodcastGenerator Stored Cross-Site Scripting via Freebox Content Field

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface themefreebox.php. Malicious JavaScript payloads injected into the Freebox content execute when users visit the application's home page...

CVE-2023-53919

CVE-2023-53919 affects PodcastGenerator 3.2.9, with a stored cross-site scripting flaw in the Freebox content field via the theme_freebox.php interface. Attacker-supplied JavaScript placed in Freebox content can execute when users visit the home page. Public documentation confirms the issue and p...

CVE-2023-53920

CVE-2023-53920 concerns PodcastGenerator 3.2.9, with a stored cross-site scripting (XSS) vulnerability in the podcast title field exposed via the podcast_details.php interface. The malicious payloads injected into the podcast title can execute when users visit the application’s home page, indicat...

CVE-2023-53919 PodcastGenerator Stored Cross-Site Scripting via Freebox Content Field

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface themefreebox.php. Malicious JavaScript payloads injected into the Freebox content execute when users visit the application's home page...

CVE-2023-53918 PodcastGenerator Stored Cross-Site Scripting via Episode Title Field

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible through the episodes upload interface episodesupload.php. Malicious JavaScript payloads injected into episode titles execute when administrators view the episodes list page...

CVE-2023-53918

PodcastGenerator 3.2.9 is affected by a stored cross-site scripting (XSS) flaw in the episode title field. The vulnerability arises when titles are submitted via the episodes_upload.php interface and is triggered when administrators load episodes_list.php, where injected JavaScript can execute in...