| 제목 | ZHENFENG13 https://github.com/ZHENFENG13/My-Blog <=1.0.0 Stored XSS |
|---|
| 설명 | The endpoint /admin/tags/save does not perform strict validation on user-controlled input, thus allowing attackers to insert malicious code into the database. When outputting content at the endpoint /admin/tags, no encoding is performed either, resulting in a stored XSS vulnerability.
Additionally, this application has no CSRF protection, enabling attackers to exploit CSRF to trick admin users into adding tag names containing malicious code. |
|---|
| 원천 | ⚠️ https://github.com/ZHENFENG13/My-Blog/issues/147 |
|---|
| 사용자 | ZAST.AI (UID 87884) |
|---|
| 제출 | 2025. 08. 04. AM 09:05 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 08. 17. PM 04:07 (13 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 320423 [zhenfeng13 My-Blog 까지 1.0.0 Tag /admin/tags/save 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|