| शीर्षक | Realce Tecnologia Queue ticket kiosk web application N/A Stored Cross Site Scripting |
|---|
| विवरण | Title: Realce Tecnologia queue ticket kiosk vulnerable to Stored XSS in admin user creation page
Software affected: Realce tecnologia web application in queue ticket kiosk (There is no version in the application pages)
Vendor: Realce Tecnologia - https://www.realcetecnologia.com.br/
Description:
The queue ticket kiosk's web application allows the creation of administrative users. The Name field does not properly sanitize input, allowing persistent (stored) cross-site scripting (XSS) attacks.
Technical Details:
An attacker can insert malicious JavaScript into the Name field when creating a new admin user. This script is stored and executed whenever the user list or profile is viewed in the application interface.
Impact:
The malicious code can be executed in the context of any user who views the affected page, leading to session hijacking, data theft, or privilege escalation.
The exploitation evidences will be sent by e-mail. |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 17/05/2025 04:46 PM (1 वर्ष पहले) |
|---|
| संयम | 25/05/2025 07:14 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 310267 [Realce Tecnologia Queue Ticket Kiosk तक 20250517 Cadastro de Administrador Page /adm/index.php Name/Usuário क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 17 |
|---|