Description
Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file parameter in index.php. The application does not sufficiently encode user-controlled inputs, allowing attackers to execute arbitrary JavaScript in victim's browsers by crafting malicious URLs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jokkedk | Webgrind | 1.1 | — |
References
- ExploitDB-51074 exploit
- Webgrind GitHub Repository product
- VulnCheck Advisory: Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) via file Parameter third-party-advisory