{“lastseen”:”2026-04-13T17:45:45″,”description”:”Pachno version 1.0.6 suffers from persistent cross site scripting vulnerabilities…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Pachno 1.0.6 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:218854″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”Pachno 1.0.6 Stored Cross-Site Scripting\\n \\n \\n Vendor: Daniel Andr\u00e9 Eikeland\\n Product web page: https:\/\/github.com\/pachno\/pachno\\n Affected version: 1.0.6\\n \\n Summary: Pachno is an open-source collaboration platform (formerly known as The Bug Genie)\\n designed for team project management, issue tracking, and documentation. It offers a module-based,\\n customizable environment for software development and team workflows, distributed under the\\n Mozilla Public License.\\n \\n Desc: Input passed to the POST parameters value, comment_body, article_content, description\\n and message via multiple controllers is not properly sanitised before being stored in the\\n database and returned to the user. The application explicitly bypasses its own htmlspecialchars()\\n sanitiser by calling Request::getRawParameter() or Request::getParameter($name, null, false).\\n This can be exploited to execute arbitrary HTML and script code in a user’s browser session in\\n context of an affected site.\\n \\n Tested on: GNU\/Linux\\n Apache2\\n PHP\/7.4\\n MySQL\/5.7 (MariaDB)\\n \\n \\n Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\n @zeroscience\\n \\n \\n Advisory ID: ZSL-2026-5980\\n Advisory URL: https:\/\/www.zeroscience.mk\/#\/advisories\/ZSL-2026-5980\\n \\n \\n 06.04.2026\\n \\n –\\n \\n \\n POST \/docs\/r\/123\/edit HTTP\/1.1\\n Host: 127.0.0.1\\n Content-Type: application\/x-www-form-urlencoded\\n Cookie: username=zeroscience; session_token=0123xxx\\n \\n article_content=\\u003csvg onload=alert(‘251’)\\u003e”,”sourceHref”:”https:\/\/packetstorm.news\/download\/218854″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/218854\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-13T17:45:45″,”description”:”Pachno version 1.0.6 suffers from persistent cross site scripting vulnerabilities…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Pachno 1.0.6 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:218854″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”Pachno 1.0.6 Stored Cross-Site Scripting\\n \\n \\n Vendor: Daniel Andr\u00e9 Eikeland\\n…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-46373","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n