| Title | dayrui xunruicms 4.6.3 Stored Cross Site Scripting |
|---|
| Description | For detailed information, please refer to: https://github.com/dayrui/xunruicms/issues/7
payload：<iframe src=javascript:alert(1)>
is different from CVE-2024-31634，<svg> can not use here
dayrui XunruiCMS 4.6.3 is vulnerable to a stored XSS (Cross-Site Scripting) vulnerability. This vulnerability exists in the "Website Information - Friendly Links" section, where links are displayed using <a href="link">. The system can parse Unicode encoding, and by closing the tag using Unicode encoding to bypass the restrictions, a stored XSS attack can be triggered.
|
|---|
| Source | ⚠️ https://github.com/dayrui/xunruicms/issues/7 |
|---|
| User | SecHZredo (UID 81966) |
|---|
| Submission | 02/28/2025 05:41 AM (5 months ago) |
|---|
| Moderation | 03/09/2025 08:05 AM (9 days later) |
|---|
| Status | Accepted |
|---|
| VulDB Entry | 299051 [dayrui XunRuiCMS up to 4.6.3 Friendly Links Website Address cross site scripting] |
|---|
| Points | 20 |
|---|