{“lastseen”:”2026-04-14T17:32:48″,”description”:”CMS Sense version 2.0 suffers from a cross site scripting vulnerability…”,”published”:”2026-04-14T00:00:00″,”modified”:”2026-04-14T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 CMS Sense 2.0 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:218892″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”==================================================================================================================================\\n | # Title : CMS sense v 2.0 HTML Injection Leading to XSS via Attribute Breakout |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/senseconseil.com\/en\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : A vulnerability has been identified in a content management script due to improper input sanitization. An attacker can inject \\n malicious HTML payloads such as \\”\\u003e\\u003cb\\u003etest\\u003c\/b\\u003e to break out of HTML attributes and manipulate the DOM structure. \\n \\t\\t\\t\\t This issue can be escalated into Cross-Site Scripting (XSS), allowing execution of arbitrary JavaScript in the victim\u2019s browser. \\n Successful exploitation may lead to session hijacking, cookie theft, and unauthorized actions performed on behalf of the user.\\n \\n [+] POC : in search box https:\/\/127.0.0.1\/fr\/recherche\\n \\n \\n An attacker can break the context of HTML attributes using a simple payload like: \\”\\u003e\\u003cb\\u003etest\\u003c\/b\\u003e\\n \\n This results in the insertion of unauthorized HTML elements into the page and can later be developed into a JavaScript execution.\\n \\n [+] Technical Details :\\n \\n The application displays user input within an HTML element without any filtering: \\u003cinput value=\\”USER_INPUT\\”\\u003e\\n \\n When the following is entered: \\”\\u003e\\u003cb\\u003etest\\u003c\/b\\u003e\\n \\n It is interpreted as follows: \\u003cinput value=\\”\\”\\u003e\\u003cb\\u003etest\\u003c\/b\\u003e\\”\\u003e\\n \\n [+] Context broken and a new HTML element injected\\n \\n [+] Proof of Concept Payload:\\”\\u003e\\u003cscript\\u003ealert(document.cookie)\\u003c\/script\\u003e\\n \\n [+] Steps to Reproduce\\n \\n Go to any input field within the script (form\/URL parameter)\\n \\n Enter the following payload: \\”\\u003e\\u003cscript\\u003ealert(1)\\u003c\/script\\u003e\\n \\n [+] Send the request\\n \\n The JavaScript will be executed in the browser\\n \\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/218892″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/218892\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-14T17:32:48″,”description”:”CMS Sense version 2.0 suffers from a cross site scripting vulnerability…”,”published”:”2026-04-14T00:00:00″,”modified”:”2026-04-14T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 CMS Sense 2.0 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:218892″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”==================================================================================================================================\\n | # Title : CMS sense v 2.0…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-46970","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n