Cross-site Scripting (XSS) - Stored in volmarg/personal-management-system
Valid
Reported on
Jul 4th 2021
💥 BUG
XSS via issue-name
💥 IMPACT
xss allow to execute arbitary javascript in vicitm account
💥 STEP TO REPRODUCE
1. goto http://personal-management-system.pl/my-issues/pending and create a new issue .
During creation put bellow xss payload in name field and save it.
xss"'><img src=x onerror=alert()>
Now whenever you visit http://personal-management-system.pl/my-issues/pending then xsss is executed .
💥 VIDEO
https://drive.google.com/file/d/1_uCpFemhsu1qKuxAofi8Gmeo4d8C5KVG/view?usp=sharing
Occurrences
ranjit-git modified the report
2 years ago
plz contact them via dwlodarczyk13@tlen.pl
see https://github.com/Volmarg/personal-management-system/issues/64 for more info
We have contacted a member of the
volmarg/personal-management-system
team and are waiting to hear back
2 years ago
2 years ago
Hey ranjit, contacted maintainer again via email provided from Github issue. Let's wait to hear back.
to join this conversation