| タイトル | code-projects Online Job Portal System 1.0 Improper Neutralization of Alternate XSS Syntax |
|---|
| 説明 | Core Components & Features
News Management Module
A Create News section at the top allows administrators to add new news items by entering the News content and News Date.
A News List table displays all existing records, showing:
Id: The unique record ID.
News: The title/content of the news item.
Date: The publication date.
Edit / Delete: Functional links for modifying or removing records.
Evidence of Vulnerability Exploitation
The pop-up dialog 8080-75f64ce3245bfb8f.monkeycode-ai.online containing the value 1 indicates that an XSS (Cross-Site Scripting) attack was successfully executed.
The third news item (ID 3) shows only the number 1 in the News field, which is the result of the injected script (alert(1)) running.
This confirms that the application is vulnerable to Stored XSS, where malicious scripts are saved to the database and executed for all users who view the page.
|
|---|
| ソース | ⚠️ https://github.com/shihuizhang-dazhi/MY-CVE/issues/8 |
|---|
| ユーザー | dazhi (UID 87857) |
|---|
| 送信 | 2026年06月11日 13:08 (4 月 ago) |
|---|
| モデレーション | 2026年07月13日 23:19 (1 month later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 249818 [Online Job Portal 1.0 Create News Page /Admin/News.php クロスサイトスクリプティング] |
|---|
| ポイント | 0 |
|---|