| عنوان | Code-projects ONLINE MUSIC SITE V1.0 Storage XSS vulnerability |
|---|
| الوصف | A Storage XSS vulnerability was found in the "Feedback.php" file of the "ONLINE MUSIC SITE" project. Root Cause Because Feedback.php does not escape, clean or parameterize the POST request data submitted, when the attacker submits a malicious Payload in the fname, femail, faddress, fmessage field (for example,"<img src=x onerror=alert(1)>"), the code does not block it and permanently stores it in the "tblfeedback"” table of the database. When “Feedback.php” reads the malicious fname, femail, faddress, fmessage data in the database, and original data to an HTML page as-is, the browser will <script>treat the HTML tag and execute its content. Immediate corrective actions are essential to safeguard system security and uphold data integrity. |
|---|
| المصدر | ⚠️ https://github.com/qwessec/CVE/issues/1 |
|---|
| المستخدم | qwcc (UID 78749) |
|---|
| ارسال | 31/05/2026 02:30 PM (30 أيام منذ) |
|---|
| الاعتدال | 28/06/2026 08:19 PM (28 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 374575 [code-projects Online Music Site 1.0 POST Request /Frontend/Feedback.php fname/femail/faddress/fmessage البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|