| Название | z-9527 admin ≤ commit 72aaf2d Cross Site Scripting |
|---|
| Описание | A stored Cross-Site Scripting (XSS) vulnerability exists in Z-9527 Admin ≤ commit 72aaf2d at the message board functionality, where the /message/create endpoint accepts user-supplied message content without sanitization or validation, stores it directly in the database, and the React frontend renders this content using dangerouslySetInnerHTML without sanitization or validation. As a result, authenticated attackers can inject arbitrary JavaScript that executes in the browsers of users viewing the message board, potentially leading to session hijacking, credential theft, or malicious actions performed on behalf of victims. Mitigations include implementing HTML sanitization using libraries like DOMPurify, avoiding dangerouslySetInnerHTML in favor of safe React rendering, implementing Content Security Policy (CSP) headers, encoding output context-appropriately, and validating input against a whitelist of allowed HTML tags and attributes. |
|---|
| Источник | ⚠️ https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-10 |
|---|
| Пользователь | Anonymous User |
|---|
| Представление | 16.03.2026 04:45 (25 дни назад) |
|---|
| Модерация | 31.03.2026 18:11 (16 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 354442 [z-9527 admin 1.0/2.0 Message Create Endpoint message.js межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|