OpenCMS 10.5.4 Cross Site Scripting

Alkacon OpenCMS version 10.5.4 suffers from a cross site scripting vulnerability.

MD5 | 8423f5be143ff3aca2de21f70e1be716

Description: OpenCMS v10.5.4 and before is vulnerable to cross site
scripting in New User module for parameter First Name and Last Name

Impacted URL is

Payload used in PoC is "TestXSS<img+src=x+onmouseover=alert(document.domain)

Further details is available here

Already requested for CVE, yet to receive it.

Related Posts