| शीर्षक | novel-plus novel-plus <=v4.2.0 Stored Cross-Site Scripting |
|---|
| विवरण | When the user logs in to the backend of novel-plus as an administrator, the administrator can modify the friendly links when the friendly links are displayed, but the backend does not verify and filter this part of the content, so XSS can be successfully inserted here.
Malicious users maliciously access the administrator's backend, then modify the content of the friendly link, and use the event function of the a tag to attack |
|---|
| स्रोत | ⚠️ https://github.com/JTZ-a/SRC/blob/master/novel-plus/storedXSS2/en-us.md |
|---|
| उपयोगकर्ता | JTZ- (UID 59232) |
|---|
| सबमिशन | 29/12/2023 03:18 AM (3 साल पहले) |
|---|
| संयम | 29/12/2023 01:12 PM (10 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 249307 [Novel-Plus तक 4.2.0 Friendly Link FriendLinkController.java क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 19 |
|---|