| शीर्षक | ZHENFENG13 https://github.com/ZHENFENG13/My-Blog <=1.0.0 Stored XSS |
|---|
| विवरण | This XSS vulnerability is different from the previously disclosed CVE-2023-29639 (blog article content) and CVE-2023-29636(blog article tile). This vulnerability occurs when adding blog categories, where the backend implementation lacks strict input validation, allowing XSS payloads to be inserted into the database. The frontend and backend output pages also lack proper encoding, leading to Stored XSS attacks. Additionally, this application has no CSRF protection, enabling attackers to exploit CSRF to trick admin users into adding blog category names containing malicious code. |
|---|
| स्रोत | ⚠️ https://github.com/ZHENFENG13/My-Blog/issues/146 |
|---|
| उपयोगकर्ता | ZAST.AI (UID 87884) |
|---|
| सबमिशन | 26/07/2025 06:27 PM (1 वर्ष पहले) |
|---|
| संयम | 08/08/2025 10:35 AM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 319236 [zhenfeng13 My-Blog तक 1.0.0 Category /admin/categories/save categoryName क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|