📜 Description

Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An attacker can submit a malicious payload in the Updates text field which is then rendered in the reporting view without proper sanitization. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.

🔍 Affected Versions

🛠️ Steps to Reproduce

1️⃣ Navigate to Projects → "Project Name" → Updates

2️⃣ Enter the following payload:

3️⃣ Navigate to Reporting → Projects

4️⃣ The stored payload is rendered, and the alert executes:

⚠️ Disclaimer

This project is intended for educational and ethical research purposes only. Unauthorized testing on systems without explicit permission is illegal. Use responsibly and only on systems you own or have permission to test.

🧑‍💻 Discovery

This vulnerability was discovered by Alex Perrakis (Stolichnayer).

🔗 References:

• Worklenzs Github Repository