SecPod

Learn Search

Search across all Learn content

← Back to Security Research

Micro CMS Persistent Cross-Site Scripting Vulnerability

Folks, SecPod Research Team member (Veerendra G.G) found persistent XSS flaw in Micro CMS, which can be used to gain sensitive information and launch further attacks. The flaw lies in name parameters while the web Application processes the user-supplied input and renders the content back to the clie...

Sep 27, 2010By Chandra1 min read

Folks,
SecPod Research Team member (Veerendra G.G) found persistent XSS flaw in Micro CMS, which can be used to gain sensitive information and launch further attacks. The flaw lies in name parameters while the web Application processes the user-supplied input and renders the content back to the client’s browser. The flaw can be exploited to inject arbitrary HTML codes and steal cookies and so on. Sometimes the POC/Exploit will disable adding comments for that specific post.

More information on the flaws can be found here.

Featured Posts

Open Plex Releases Security Fixes for Media Server and Desktop Clients - Users Urged to Update Immediately
Plex Releases Security Fixes for Media Server and Desktop Clients - Users Urged to Update Immediately

CVE Research

Plex Releases Security Fixes for Media Server and Desktop Clients - Users Urged to Update Immediately

Plex has released security updates for Plex Media Server and Plex Desktop and is urging users to upgrade immediately. Plex Media Server v1.43.2 and earlier should be moved to version 1.43.3; Plex Desktop should be updated to 1.115.0. CVE identifiers have been requested, and full technical details are not public yet. This article covers the fixed versions, how to update across Windows, macOS, Linux, NAS, Docker, and other platforms, and what administrators should do now.

Sep 15, 2026

Open From Gitea Exploitation to Root Access: Uncovering Red Heron’s Global Attack Campaign
From Gitea Exploitation to Root Access: Uncovering Red Heron’s Global Attack Campaign

CVE Research

From Gitea Exploitation to Root Access: Uncovering Red Heron’s Global Attack Campaign

Sep 15, 2026

Open Active Exploitation Imminent: Two Critical Check Point Flaws (CVE-2026-85102, CVE-2026-85103) Allow Unauthenticated Remote Code Execution on VPN-Enabled Security Gateways and Management Appliances
Active Exploitation Imminent: Two Critical Check Point Flaws (CVE-2026-85102, CVE-2026-85103) Allow Unauthenticated Remote Code Execution on VPN-Enabled Security Gateways and Management Appliances

CVE Research

Active Exploitation Imminent: Two Critical Check Point Flaws (CVE-2026-85102, CVE-2026-85103) Allow Unauthenticated Remote Code Execution on VPN-Enabled Security Gateways and Management Appliances

CVE-2026-85102 and CVE-2026-85103 are critical vulnerabilities in Check Point VPN products that can allow unauthenticated remote code execution. The first flaw involves improper validation of certificate data during VPN negotiation on Security Gateways and Spark Firewalls using Site-to-Site or Remote Access VPN. The second is a heap overflow in ASN.1 certificate decoding that can affect Security Gateways, Security Management Servers, and Spark Firewalls. This article covers how the issues work, the affected products and versions, available LivePatch and Jumbo Hotfix fixes, and temporary Site-to-Site VPN mitigations.

Sep 15, 2026

Open Cisco FMC Zero-Day Under Active Attack: UAT-12197, UAT-11823 and Qilin-Linked UAT-11988 Exploit Firewall Flaws
Cisco FMC Zero-Day Under Active Attack: UAT-12197, UAT-11823 and Qilin-Linked UAT-11988 Exploit Firewall Flaws

CVE Research

Cisco FMC Zero-Day Under Active Attack: UAT-12197, UAT-11823 and Qilin-Linked UAT-11988 Exploit Firewall Flaws

Sep 11, 2026

Micro CMS Persistent Cross-Site Scripting Vulnerability | SecPod