| शीर्षक | bdtaks Garage 24 Latest version as of 2025-10-16 Stored HTML Injection |
|---|
| विवरण | A stored HTML injection vulnerability exists in bdTask Garage 24 in the /edit_profile functionality. The first_name and last_name parameters insufficiently neutralize user-supplied HTML before the values are stored and subsequently rendered. An authenticated attacker can inject HTML elements such as hyperlinks, which are persisted by the application and rendered when the affected profile information is displayed. This can be abused to alter displayed content or present attacker-controlled links to users, creating a potential phishing vector. |
|---|
| स्रोत | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/30 |
|---|
| उपयोगकर्ता | 4m3rr0r (UID 85795) |
|---|
| सबमिशन | 04/10/2026 06:10 PM (24 दिन पहले) |
|---|
| संयम | 26/10/2026 11:01 AM (22 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 426354 [Bdtask Garage 24 Garage Management Software 1.0 Profile /edit_profile first_name/last_name क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|