Skip to content
ביקורת אבטחה
חזרה ללוח
D53אומת בקודP0

Stored XSS via buyer name/NID into ticket SVG served `image/svg+xml`

B · unauth-POSTS3 · destructiveSECT1
תיקון
85%
מורכבות low

A buyer's name flows unescaped into an SVG ticket served as an image, allowing stored cross-site scripting.

Tickets.php:92, ticket.php:122

תיק מלא
ממצאים קשורים
D02 · Ticket IDOR: any buyer's name + phone…D49 · `Tickets::ajax_render` (nopriv) regen…D39 · Stored XSS: buyer `full_name` unescap…D40 · Stored XSS in admin dashboards (guest…D67 · `ImagickException` caught in wrong na…