Stored XSS in Resources in francoisjacquet/rosariosis


Reported on

Jun 2nd 2022


Website does incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Steps to reproduce [it works on Firefox (not in chromium based browsers)]

1.Go to and login with administrator account

2.Go to

3.Create new link with content javascriptjavascript::alert(origin)

4.Click the link and observe a pop up

#Image POC


User clicking the link can be affected by malicious javascript code created by the attacker.

We are processing your report and will contact the francoisjacquet/rosariosis team within 24 hours. a month ago
Domiee13 modified the report
a month ago
We have contacted a member of the francoisjacquet/rosariosis team and are waiting to hear back a month ago
François Jacquet validated this vulnerability a month ago
Domiee13 has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
François Jacquet confirmed that a fix has been merged on adc5df a month ago
François Jacquet has been awarded the fix bounty
to join this conversation