CVE-2015-5520
Orchard 1.7.3-1.8.2 and 1.9.x < 1.9.1 - Stored Cross-Site Scripting via Username
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2015-5520. PoCs published by Paris Zoumpouloglou.
AI-analyzed exploit summary This is a writeup describing a persistent XSS vulnerability in Orchard CMS versions 1.7.3, 1.8.2, and 1.9.0. The vulnerability allows an attacker to inject malicious scripts into the Username field during user registration, which executes when an administrator attempts to delete the account.
Description
Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account.
Exploits (1)
This is a writeup describing a persistent XSS vulnerability in Orchard CMS versions 1.7.3, 1.8.2, and 1.9.0. The vulnerability allows an attacker to inject malicious scripts into the Username field during user registration, which executes when an administrator attempts to delete the account.