| शीर्षक | star7th ShowDoc 3.7.1 - 3.9.1 Cross Site Scripting |
|---|
| विवरण | [0-Day / Unpatched / Embargoed]
Vulnerability Summary:
A Stored Cross-Site Scripting (XSS) vulnerability exists in ShowDoc version v3.7.1-v3.9.1. An authenticated attacker can inject malicious JavaScript payloads, which are stored in the database and executed in the browser of other users.
Poc
See Gisk link in "Advisory/Exploit".
---
COORDINATED DISCLOSURE STATUS:
- Vendor contacted on: July 27, 2026
- Vendor notification proof: Initial disclosure email with full technical details has been sent to the official maintainer/security contact. And vendor states that a fix will be implemented soon. (Please see Gist link in https://gist.github.com/saDL0w/b2720595a5ec0bdb5cc51d7be49bb946)
- Requesting an Early Reservation CVE ID under embargo. The disclosure date/patch deadline is set to October 25, 2026, ensuring details remain strictly private until an official patch is released.The author states that a fix will be implemented soon. |
|---|
| स्रोत | ⚠️ https://gist.github.com/saDL0w/36a72a076e9ab24408a3d27582e778b2 |
|---|
| उपयोगकर्ता | LIU Tingwei (UID 97038) |
|---|
| सबमिशन | 27/07/2026 10:52 AM (1 महीना पहले) |
|---|
| संयम | 08/09/2026 11:15 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 399755 [star7th showdoc तक 3.9.1 API Page Save Endpoint editormd.js क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|