HexBrain

Stripo Inc · Report #1126433

Stored XSS at Module Name

Validstatus
mediumseverity
23upvotes
12 Apr 2021disclosed

How it was found

Summary:

Hello, I found stored xss at module name with this payload "><div onmouseover="alert('XSS');">Hello :)

Steps To Reproduce:

  1. Add new container, it doesn't matter which is it
  2. Paste this payload in the module name"><div onmouseover="alert('XSS');">Hello :)
  3. Update it then check the module name again in setting
  4. Alert Popup

Stored XSS

Stored cross-site scripting (also known as second-order or persistent XSS) arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.

Impact

Execute Js in victims browser

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original