Stripo Inc · Report #1126433
Stored XSS at Module Name
Validstatus
mediumseverity
23upvotes
12 Apr 2021disclosed
How it was found
Summary:
Hello, I found stored xss at module name with this payload "><div onmouseover="alert('XSS');">Hello :)
Steps To Reproduce:
- Add new container, it doesn't matter which is it
- Paste this payload in the module name
"><div onmouseover="alert('XSS');">Hello :) - Update it then check the module name again in setting
- Alert Popup
Stored XSS
Stored cross-site scripting (also known as second-order or persistent XSS) arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.
Impact
Execute Js in victims browser