New XSS vulnerability in source code view

yaniswang / xhEditor

xhEditor是一个基于jQuery开发的简单迷你并且高效的在线可视化HTML编辑器。

http://xheditor.com/

GNU Lesser General Public License v3.0

244 stars 79 forks source link

New XSS vulnerability in source code view #38

Open l0v3j1 opened 5 years ago

l0v3j1 commented 5 years ago

The editor's source code view allows attacker to bypass the input validation in default view by injecting javascript using details. payload: Injected the the payload<details ontoggle="alert(1)"> into the editor's source code view.