| 标题 | Open-Source SolidInvoice 2.4.0 Stored Cross-Site Scripting (XSS) |
|---|
| 描述 | SolidInvoice 2.4.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the Invoice module (/invoice). The client name parameter is not properly sanitized during invoice creation, allowing an authenticated attacker to inject malicious JavaScript code. The payload is persistently stored and is executed whenever the invoice list is accessed, impacting all authenticated users. Exploitation requires authentication.
This is PoC Stored XSS 2. The complete proof of concept and detailed exploitation steps are documented in the file: ???? PoC Stored XSS 2.md. |
|---|
| 来源 | ⚠️ https://github.com/Gabrielmouraofc/PoC_Vuldb.git |
|---|
| 用户 | GabrielMoura (UID 88644) |
|---|
| 提交 | 2025-08-08 02時55分 (10 月前) |
|---|
| 管理 | 2025-08-19 15時37分 (12 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 320545 [SolidInvoice 直到 2.4.0 Invoice Creation /invoice Client Name 跨网站脚本] |
|---|
| 积分 | 20 |
|---|