WUZHI CMS 4.1.0 - tag[pinyin] Cross-Site Scripting

WUZHI CMS 4.1.0 - tagpinyin Cross-Site Scripting Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability Date: 2018-4-23 Exploit Author: jiguang [email protected] Vendor Homepage: https://github.com/wuzhicms/wuzhicms Software Link: https://github.com/wuzhicms/wuzhicms Version: 4.1.0 CVE: CVE-2018-10311 An...

WUZHI CMS 4.1.0 - 'tag[pinyin]' Cross-Site Scripting

Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability Date: 2018-4-23 Exploit Author: jiguang [email protected] Vendor Homepage: https://github.com/wuzhicms/wuzhicms Software Link: https://github.com/wuzhicms/wuzhicms Version: 4.1.0 CVE: CVE-2018-10311 An issue was discovered in WUZHI CMS 4.1.0...

CVE-2018-10311

WUZHI CMS 4.1.0 is affected by a persistent XSS in the tag[pinyin] input when calling the API at /index.php?m=tags&f=index&v=add. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the tag[pinyin] parameter. Multiple sources (including Exploit-DB and PT-Security)...