{“lastseen”:”2026-04-29T17:07:09″,”description”:”OpenNebula version 6.10.0.1 suffers from multiple persistent cross site scripting vulnerabilities…”,”published”:”2026-04-29T00:00:00″,”modified”:”2026-04-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 OpenNebula 6.10.0.1 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:220040″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-56534″,”CVE-2025-56535″,”CVE-2025-56536″,”CVE-2025-56537″],”sourceData”:”# OpenNebula-CVE-2025-56537\\n \\n **Exploit Title :** OpenNebula 6.10.0.1 – Stored XSS (Cross-site Scripting) in virtual network template \\n **Exploit Author :** Mark Artamonov \\n **Vendor Homepage :** https:\/\/opennebula.io\/ \\n **Tested Version :** OpenNebula 6.10.0.1 \\n **Affected Versions :** OpenNebula \\u003c 7.0 \\n **Affected Component :** opennebula-sunstone \\n **CVE ID :** CVE-2025-56537 \\n \\n ### **Description:**\\n A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the virtual network template parameter.\\n \\n ### **Payload :**\\n “`\\n \\u003cimage src =q onerror=prompt(8)\\u003e\\n “`\\n \\n ## **Proof of Concept :**\\n \\u003cimg width=\\”1063\\” height=\\”645\\” alt=\\”\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/6d19c255-500f-4280-8802-ac993157334a\\” \/\\u003e\\n \\u003cbr\\u003e\\n \\u003cimg width=\\”1190\\” height=\\”750\\” alt=\\”\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/bb89b5f8-4f3f-4da9-a2a8-2256f7e7c420\\” \/\\u003e\\n \\n ### **Fix :**\\n Upgrade to OpenNebula \\u003e=7.0.\\n \\n —————-\\n \\n # OpenNebula-CVE-2025-56536\\n \\n **Exploit Title :** OpenNebula 6.10.0.1 – Stored XSS (Cross-site Scripting) in user information \\n **Exploit Author :** Mark Artamonov \\n **Vendor Homepage :** https:\/\/opennebula.io\/ \\n **Tested Version :** OpenNebula 6.10.0.1 \\n **Affected Versions :** OpenNebula \\u003c 7.0 \\n **Affected Component :** opennebula-sunstone \\n **CVE ID :** CVE-2025-56536 \\n \\n ### **Description:**\\n A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the user information parameter.\\n \\n ### **Payload :**\\n “`\\n \\u003cimage src =q onerror=prompt(8)\\u003e\\n “`\\n \\n ## **Proof of Concept :**\\n \\u003cimg width=\\”1779\\” height=\\”694\\” alt=\\”\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/b493d771-441d-4b17-9915-164d30bd89e9\\” \/\\u003e\\n \\u003cbr\\u003e\\n \\u003cimg width=\\”1439\\” height=\\”740\\” alt=\\”\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/f712d182-f5ba-417e-8a43-7caee949c56c\\” \/\\u003e\\n \\n ### **Fix :**\\n Upgrade to OpenNebula \\u003e=7.0.\\n \\n —————-\\n \\n # OpenNebula-CVE-2025-56535\\n \\n **Exploit Title :** OpenNebula 6.10.0.1 – Stored XSS (Cross-site Scripting) in zone attribute \\n **Exploit Author :** Mark Artamonov \\n **Vendor Homepage :** https:\/\/opennebula.io\/ \\n **Tested Version :** OpenNebula 6.10.0.1 \\n **Affected Versions :** OpenNebula \\u003c 7.0 \\n **Affected Component :** opennebula-sunstone \\n **CVE ID :** CVE-2025-56535 \\n \\n ### **Description:**\\n A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the zone attribute parameter.\\n \\n ### **Payload :**\\n “`\\n \\u003cimage src =q onerror=prompt(8)\\u003e\\n “`\\n \\n ## **Proof of Concept :**\\n \\u003cimg width=\\”1063\\” height=\\”755\\” alt=\\”\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/4a034b1f-b5a6-464a-a680-d0bbdb73ed93\\” \/\\u003e\\n \\u003cbr\\u003e\\n \\u003cimg width=\\”1107\\” height=\\”749\\” alt=\\”\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/421b8745-6207-4d56-9447-0b15c5a45314\\” \/\\u003e\\n \\n ### **Fix :**\\n Upgrade to OpenNebula \\u003e=7.0.\\n \\n —————-\\n \\n # OpenNebula-CVE-2025-56534\\n \\n **Exploit Title :** OpenNebula 6.10.0.1 – Stored XSS (Cross-site Scripting) in the custom authenticator driver \\n **Exploit Author :** Mark Artamonov \\n **Vendor Homepage :** https:\/\/opennebula.io\/ \\n **Tested Version :** OpenNebula 6.10.0.1 \\n **Affected Versions :** OpenNebula \\u003c 7.0 \\n **Affected Component :** opennebula-sunstone \\n **CVE ID :** CVE-2025-56534 \\n \\n ### **Description:**\\n A stored cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.\\n \\n ### **Payload :**\\n “`\\n \\u003cimage src =q onerror=prompt(8)\\u003e\\n “`\\n \\n ## **Proof of Concept :**\\n \\u003cimg width=\\”1063\\” height=\\”698\\” alt=\\”\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/33097697-e151-437a-9480-7b7ddb094363\\” \/\\u003e \\n \\u003cbr\\u003e\\n \\u003cimg width=\\”1440\\” height=\\”711\\” alt=\\”\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/c9b57595-2dbb-4d67-880f-131664c0a6aa\\” \/\\u003e\\n \\n ### **Fix :**\\n Upgrade to OpenNebula \\u003e=7.0.”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220040″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220040\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-29T17:07:09″,”description”:”OpenNebula version 6.10.0.1 suffers from multiple persistent cross site scripting vulnerabilities…”,”published”:”2026-04-29T00:00:00″,”modified”:”2026-04-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 OpenNebula 6.10.0.1 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:220040″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-56534″,”CVE-2025-56535″,”CVE-2025-56536″,”CVE-2025-56537″],”sourceData”:”# OpenNebula-CVE-2025-56537\\n \\n **Exploit Title :** OpenNebula 6.10.0.1 – Stored…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-50206","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n