medium5.4Public exploit code
CVE-2021-3355
A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- LightCMS 1.3.4 - 'exclusive' Stored XSS2021-02-26 · webapps · multiple
Impact
A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lightcms Project | Lightcms | Version 1.3.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/161562/LightCMS-1.3.4-Cross-Site-Scripting.html
- https://gist.github.com/Peithon/1c628ded0c4fc96c6331c3cce1d0c69b
- https://github.com/eddy8/LightCMS/issues/18
- https://www.exploit-db.com/exploits/49598
- http://packetstormsecurity.com/files/161562/LightCMS-1.3.4-Cross-Site-Scripting.html
- https://gist.github.com/Peithon/1c628ded0c4fc96c6331c3cce1d0c69b
- https://github.com/eddy8/LightCMS/issues/18
- https://www.exploit-db.com/exploits/49598