CVE-2021-27370
MEDIUMMonica 2.19.1 - Stored Cross-Site Scripting via Last Name Field
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-27370. PoCs published by BouSalman.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Monica 2.19.1 by injecting a malicious payload into the 'last_name' field, which executes JavaScript when rendered. The payload uses constructor.constructor to bypass input validation and trigger an alert with the document.cookie.
Description
The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.
Exploits (1)
This exploit demonstrates a stored XSS vulnerability in Monica 2.19.1 by injecting a malicious payload into the 'last_name' field, which executes JavaScript when rendered. The payload uses constructor.constructor to bypass input validation and trigger an alert with the document.cookie.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N