The Log module in SECUDOS DOMOS before 5.6 allows XSS.
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Link | Tags |
---|---|
https://www.secudos.de/news-und-events/aktuelle-news/domos-release-5-6 | third party advisory release notes |
https://atomic111.github.io/article/secudos-domos-reflected-xss | third party advisory exploit |