| शीर्षक | PodcastGenerator 3.2.9 Cross Site Scripting |
|---|
| विवरण | Vulnerability Files
File
Line
Function
core/freebox.php
20-23
updateFreebox() - Unsafe storage
core/freebox.php
11-18
getFreebox() - Raw content retrieval
admin/theme_freebox.php
28
Admin input handler
admin/theme_freebox.php
59
Admin preview output (no encoding)
themes/default/jumbotron.php
33
Frontend output (no encoding)
Description
A Stored Cross-Site Scripting (XSS) vulnerability exists in PodcastGenerator <= 3.2.9. The Freebox feature allows administrators to input arbitrary HTML/JavaScript content that is stored without any sanitization and rendered on the public-facing homepage without proper output encoding. This allows an attacker with admin access to inject malicious JavaScript code that will execute in the browsers of all users visiting the website. |
|---|
| स्रोत | ⚠️ https://note-hxlab.wetolink.com/share/0j1bwrx0ibiz |
|---|
| उपयोगकर्ता | hiro (UID 93548) |
|---|
| सबमिशन | 20/12/2025 01:33 PM (10 महीनों पहले) |
|---|
| संयम | 01/01/2026 10:33 AM (12 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 337114 [PodcastGenerator 3.2.9 Theme Customization Interface theme_freebox.php Freebox content क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|