Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)

Exploit Title: Cloudron 6.2 - 'returnTo ' Cross Site Scripting Reflected Date: 10.06.2021 Exploit Author: Akıner Kısa Vendor Homepage: https://cloudron.io Software Link: https://www.cloudron.io/get.html Version: 6.3 CVE : CVE-2021-40868 Proof of Concept: 1. Go to...

Cloudron 6.2 Cross Site Scripting

Exploit Title: Cloudron 6.2 - 'returnTo ' Cross Site Scripting Reflected Date: 10.06.2021 Exploit Author: Akıner Kısa Vendor Homepage: https://cloudron.io Software Link: https://www.cloudron.io/get.html Version: 6.3 CVE : CVE-2021-40868 Proof of Concept: 1. Go to...

CVE-2021-40868

CVE-2021-40868 affects Cloudron 6.2, where the login page’s returnTo parameter is vulnerable to reflected Cross-Site Scripting (XSS). The issue arises in the handling of the returnTo input on the login page, enabling execution of arbitrary JavaScript in the victim’s browser. Public sources descri...