| शीर्षक | xingfuggz baykeShop 1.3.25 Cross Site Scripting |
|---|
| विवरण | A stored cross‑site scripting (XSS) vulnerability exists in the BaykeShop article sidebar module.
The template src/baykeshop/contrib/article/templates/baykeshop/sidebar/custom.html renders the sidebar.content field without escaping by using the Django |safe filter.
If an attacker (typically an administrative or content editor user) can inject arbitrary HTML/JavaScript into the sidebar content via the admin panel or any other input mechanism that writes to the Sidebar model, the payload is stored in the database and will be executed in the browsers of all visitors who view any page that includes this sidebar.
This allows session hijacking, defacement, credential theft, or further administrative actions performed on behalf of the victim. |
|---|
| स्रोत | ⚠️ https://github.com/xingfuggz/baykeShop/issues/1 |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 12/02/2026 01:09 PM (6 महीनों पहले) |
|---|
| संयम | 23/02/2026 05:41 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 347397 [xingfuggz BaykeShop तक 1.3.20 Article Sidebar custom.html sidebar.content क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|