XSS vulnerability in Hexo-admin post editor
Open
- Dominant language
- JavaScript
- Stars
- 1.8k
- Forks
- 299
- PR merge metrics
- No merged PRs in 30d
Description
Cross site scripting vulnerability in the plugins posts editor.
Video PoC is attached [[PLUGIN] Hexo-admin-XSS-PoC.zip](https://github.com/jaredly/hexo-admin/files/3077011/PLUGIN.Hexo-admin-XSS-PoC.zip)
Payload : ">
Other payloads like document.cookie and document.domain is also working.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the reported payload in the plugins posts editor using the attached PLUGIN.Hexo-admin-XSS-PoC.zip video and payload. Trace the editor entry point and verify that the supplied XSS, document.cookie, and document.domain payloads no longer execute; add or update coverage if the repository provides a relevant test location.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100