| 标题 | code-projects Online Job Portal System 1.0 Improper Neutralization of Alternate XSS Syntax |
|---|
| 描述 | Core Components & Features
News Management Module
A Create News section at the top allows administrators to add new news items by entering the News content and News Date.
A News List table displays all existing records, showing:
Id: The unique record ID.
News: The title/content of the news item.
Date: The publication date.
Edit / Delete: Functional links for modifying or removing records.
Evidence of Vulnerability Exploitation
The pop-up dialog 8080-75f64ce3245bfb8f.monkeycode-ai.online containing the value 1 indicates that an XSS (Cross-Site Scripting) attack was successfully executed.
The third news item (ID 3) shows only the number 1 in the News field, which is the result of the injected script (alert(1)) running.
This confirms that the application is vulnerable to Stored XSS, where malicious scripts are saved to the database and executed for all users who view the page.
|
|---|
| 来源 | ⚠️ https://github.com/shihuizhang-dazhi/MY-CVE/issues/8 |
|---|
| 用户 | dazhi (UID 87857) |
|---|
| 提交 | 2026-06-11 13時08分 (4 月前) |
|---|
| 管理 | 2026-07-13 23時19分 (1 month later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 249818 [Online Job Portal 1.0 Create News Page /Admin/News.php 跨网站脚本] |
|---|
| 积分 | 0 |
|---|