| Titolo | code-projects Project Management System 1.0 Cross Site Scripting |
|---|
| Descrizione | PMS contains a stored cross-site scripting (XSS) vulnerability in its mail and feedback workflow. User-controlled content is written to the backend database and later rendered in HTML without output encoding. As a result, a malicious payload can be stored through the mail compose form or the feedback submission path and will execute when another user opens the corresponding mail view or feedback page. The issue affects both the Faculty and Student mail modules, as well as the feedback display flow.
The root cause is unsafe handling of untrusted input in both storage and presentation. In the mail modules, message content is inserted into the database and later echoed back into the page without escaping. In the feedback workflow, the submitted feedback value is stored in the project record and then rendered directly inside a <textarea> without encoding. During testing, the payload <img src=x onerror=alert(1)> was successfully stored and later executed in the browser, confirming the presence of a reproducible stored XSS condition. |
|---|
| Fonte | ⚠️ https://github.com/MyMySSS/CVE123/blob/main/cve4/PMS_CVE_Submission.md |
|---|
| Utente | MyMy (UID 96642) |
|---|
| Sottomissione | 27/05/2026 11:56 (1 mese fa) |
|---|
| Moderazione | 27/06/2026 20:29 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 374499 [code-projects Project Management System 1.0 Mail Compose Page /mail.php cross site scripting] |
|---|
| Punti | 20 |
|---|