| शीर्षक | Jcharis Machine-Learning-Web-Apps <=1.0.0 Reflected XSS |
|---|
| विवरण | The POST /preview endpoint takes user input from request.form['newtext']
and passes it directly to render_template() as a template variable. If
the Jinja2 template renders newtext without escaping (e.g. using {{
newtext | safe }}), arbitrary HTML/JavaScript is injected into the
response. The POC submits <img src=1 onerror=alert(9)> and the payload
executes in the browser, confirming Reflected XSS. An attacker can craft
a malicious link to steal session cookies or perform actions on behalf of
the victim. |
|---|
| स्रोत | ⚠️ https://github.com/Jcharis/Machine-Learning-Web-Apps/issues/15 |
|---|
| उपयोगकर्ता | ZAST.AI (UID 87884) |
|---|
| सबमिशन | 26/02/2026 01:54 PM (7 महीनों पहले) |
|---|
| संयम | 11/03/2026 01:56 PM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 350391 [Jcharis Machine-Learning-Web-Apps तक a6996b634d98ccec4701ac8934016e8175b60eb5 Jinja2 Template app.py render_template क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|