Description (CNA)
Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by submitting unfiltered JavaScript code in the long_description parameter. Attackers can inject script tags through episode creation or editing requests to execute arbitrary JavaScript when other users view the episode details.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Podcastgenerator / Podcast Generator | affected < 3.1.1 |
CWE
CWE-79
References
- https://www.exploit-db.com/exploits/49866
- https://podcastgenerator.net/demoV2/
- https://podcastgenerator.net/download
- https://www.vulncheck.com/advisories/podcast-generator-persistent-cross-site-scripting-via-long-description
ADP enrichment
No English description supplied.
No references supplied.