| عنوان | Mettle sendportal v3.0.1 Cross Site Scripting |
|---|
| الوصف | A Stored Cross-Site Scripting (XSS) vulnerability exists in the campaign content rendering functionality. An authenticated user can inject arbitrary JavaScript into the content field, which is later rendered without sanitization using Laravel Blade’s {!! !!} directive.
This results in execution of attacker-controlled JavaScript when:
The campaign preview page is opened
The public webview link (/webview/{hash}) is accessed |
|---|
| المصدر | ⚠️ https://github.com/mettle/sendportal/issues/338 |
|---|
| المستخدم | B1scuit (UID 97177) |
|---|
| ارسال | 08/05/2026 07:49 AM (5 أشهر منذ) |
|---|
| الاعتدال | 31/05/2026 10:14 AM (23 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 367513 [Mettle sendportal حتى 3.0.1 Campaign /webview/ content البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|