| शीर्षक | Open-Source SolidInvoice 2.4.0 PoC – Stored XSS via Client Name Field in SolidInvoice 2.4.0 |
|---|
| विवरण | SolidInvoice 2.4.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the Clients module (/clients). The name parameter in the Add New Client form is not properly sanitized, allowing an authenticated attacker to inject malicious JavaScript code. The payload is stored in the database and executed automatically whenever the clients list is accessed, resulting in persistent JavaScript execution in the browsers of authenticated users. Exploitation requires authentication.
This is PoC Stored XSS #5. The complete proof of concept and detailed exploitation steps are documented in the file: ???? PoC Stored XSS #5 - Client Name Field – SolidInvoice 2.4.0. |
|---|
| स्रोत | ⚠️ https://github.com/Gabrielmouraofc/PoC_Vuldb.git |
|---|
| उपयोगकर्ता | GabrielMoura (UID 88644) |
|---|
| सबमिशन | 08/08/2025 03:41 AM (10 महीनों पहले) |
|---|
| संयम | 19/08/2025 03:37 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 320548 [SolidInvoice तक 2.4.0 Clients /clients नाम क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|