[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] =?utf-8?q?Centraleyezer=3A_Stored_XSS_using_HTML_Entities_?= =?utf-8?b?4oCUIFtDVkUtMjAxOeKAkzEy
From:       infinitybuzz via Fulldisclosure <fulldisclosure () seclists ! org>
Date:       2019-11-12 16:40:43
Message-ID: xd90kL14IjY3eg_rVj54r5JwH9y-v8akwbp6EZ3XfQ8a_lEjSUQlOgk5C4xSd0zTH1QfiTmohtpfuTD7i-K9IAa9AmCI4UqVqNUatW8E3m8= () protonmail ! com
[Download RAW message or body]

Centraleyezer: Stored XSS using HTML Entities — [CVE-2019–12299]

Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of \
the Category section.

I could bypass the restrictions using HTML Entities &gt &lt, the Stored XSS only triggers when \
editing the category.

More Information:

https://link.medium.com/5galrOpMy1

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


[prev in list] [next in list] [prev in thread] [next in thread]