| शीर्षक | PodcastGenerator 3.2.9 Cross Site Scripting |
|---|
| विवरण | Vulnerability Files#
File Line Function
admin/episodes_upload.php 290 shortdescPG stored in CDATA without sanitization
admin/episodes_upload.php 291 longdescPG stored in CDATA without sanitization
themes/default/singleepisode.php 51 titlePG output without encoding
themes/default/singleepisode.php 53 shortdescPG output without encoding
themes/default/singleepisode.php 56 longdescPG output without encoding
themes/default/listepisodes.php 41 titlePG output without encoding
themes/default/listepisodes.php 44 shortdescPG output without encoding
Description#
A Stored Cross-Site Scripting (XSS) vulnerability exists in PodcastGenerator <= 3.2.9. When uploading a new podcast episode, the shortdesc (Short Description) and longdesc (Long Description) fields are stored in XML files using CDATA sections without any HTML sanitization. When these episodes are displayed on the public-facing website, the content is rendered directly without proper output encoding, allowing attackers to inject malicious JavaScript code that executes in visitors' browsers. |
|---|
| स्रोत | ⚠️ https://note-hxlab.wetolink.com/share/vU2zjwjagtwU |
|---|
| उपयोगकर्ता | hiro (UID 93548) |
|---|
| सबमिशन | 21/12/2025 03:05 PM (10 महीनों पहले) |
|---|
| संयम | 01/01/2026 10:33 AM (11 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 337113 [PodcastGenerator 3.2.9 Episodes Upload Interface episodes_upload.php episode title क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|