| Título | Open-Source SolidInvoice 2.4.0 Stored Cross-Site Scripting (XSS) |
|---|
| Descripción | SolidInvoice 2.4.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the Tax Rates module (/tax/rates). The name parameter in the Tax Rate creation form is not properly sanitized, allowing an authenticated attacker to inject malicious JavaScript code. The payload is stored in the database and executed automatically whenever the tax rates list is accessed, potentially impacting all authenticated users. Exploitation requires authentication.
This is PoC Stored XSS #4. The complete proof of concept and detailed exploitation steps are documented in the file: ???? PoC Stored XSS #4 - Tax Rate Name Field – SolidInvoice 2.4.0. |
|---|
| Fuente | ⚠️ https://github.com/Gabrielmouraofc/PoC_Vuldb.git |
|---|
| Usuario | GabrielMoura (UID 88644) |
|---|
| Sumisión | 2025-08-08 03:07 (hace 10 meses) |
|---|
| Moderación | 2025-08-19 15:37 (12 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 320547 [SolidInvoice hasta 2.4.0 Tax Rates /tax/rates Nombre secuencias de comandos en sitios cruzados] |
|---|
| Puntos | 20 |
|---|