Subrion CMS 4.2.1 Cross Site Scripting

Exploit Title: Subrion CMS 4.2.1 - 'avatarpath' XSS Date: 2020-12-15 Exploit Author: icekam Vendor Homepage: https://subrion.org/ Software Link: https://github.com/intelliants/subrion Version: Subrion CMS 4.2.1 CVE : CVE-2020-35437 stored xss vulnerability in /core/profile/. Reproduce through the...

Subrion CMS 4.2.1 - 'avatar[path]' XSS

Exploit Title: Subrion CMS 4.2.1 - 'avatarpath' XSS Date: 2020-12-15 Exploit Author: icekam Vendor Homepage: https://subrion.org/ Software Link: https://github.com/intelliants/subrion Version: Subrion CMS 4.2.1 CVE : CVE-2020-35437 stored xss vulnerability in /core/profile/. Reproduce through the...

CVE-2020-35437

Subrion CMS 4.2.1 is affected by: Cross Site Scripting XSS through the avatarpath parameter in a POST request to the /core/profile/ URI...

CVE-2020-35437

Subrion CMS 4.2.1 is affected by a Cross-Site Scripting (XSS) flaw via the avatar[path] parameter in a POST to the /_core/profile/ URI. The vulnerability stems from unsanitized input in avatar[path], enabling script injection. Public exploit reports describe a stored XSS; however, the provided do...