Project

General

Profile

Actions
Copy link

Bug #16920

open

Potential stored XSS in ``status_monitoring.php`` via saved views

Added by Jim Pingle about 2 months ago. Updated 12 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
Jim Pingle
Category:
Status_Monitoring
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:

Description

When saving views on status_monitoring.php none of the fields have validation, and some can be printed back to the user without encoding in certain circumstances, leading to a potential stored XSS.

Furthermore there is a lot of room for improvement/cleanup in the code around these options, and in general. At a minimum it needs validation and to check/correct the encoding when outputting category.

Files

poc-xss-graphs.py (1.54 KB) poc-xss-graphs.py Jim Pingle, 06/30/2026 07:56 PM
Actions
Copy link

Also available in: Atom