#Exploit Title:​​ Kirby CMS 2.5.12 - Cross-Site Scripting # Exploit Author: wawindaji wazimu # Version: ​2.5.12 # CVE : ​NA # Category: ​Web Application # Description # The application allows user injected payload which can lead to Stored # Cross Site Scripting. # Proof of Concept # 1. Visit the application as low private user # 2. Go to add page option # 3. Under title, enter any XSS payload like: <script>alert("XSS");</script> # 4. Upon the payload being injected, the subsequent page is triggered # with XSS