| शीर्षक | Guangzhou Qibo Network Technology Co., Ltd. Qibo CMS (x1_of_cms) X1.0 XSS |
|---|
| विवरण | The internal message (friend message) module of Qibo CMS (x1_of_cms) has a defect of insufficient input validation. When the backend system receives and stores the private message content sent by users, it does not perform effective security filtering and HTML entity escaping on the input data. Attackers can exploit this vulnerability to construct a malicious payload containing JavaScript code and send it to other users (including administrators) in the system. When the victim views the internal message on the front-end page, the malicious script will be parsed and executed by the browser. |
|---|
| स्रोत | ⚠️ https://tcn60zf28jhk.feishu.cn/wiki/FHHMwcwCliOd0Bke3XkcEz3Enuc?from=from_copylink |
|---|
| उपयोगकर्ता | EthX0_ (UID 96627) |
|---|
| सबमिशन | 31/03/2026 08:21 AM (6 महीनों पहले) |
|---|
| संयम | 20/04/2026 07:38 AM (20 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 358282 [Qibo CMS 1.0 Internal Message क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|