{"uuid": "78eb97ed-89b6-432c-829a-17e84445ca36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36654", "type": "seen", "source": "https://t.me/hacking_Attack/19109", "content": "Exploit Collector\nCMSuno 1.7 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png \nCMSuno version 1.7 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 613371e454c483238cb3032fc848c3aa\n\nDownload\n# Exploit Title: CMSuno 1.7 - 'tgo' Stored Cross-Site Scripting (XSS) (Authenticated)\n# Date: 03-08-2021\n# Exploit Author: splint3rsec\n# Vendor Homepage: https://github.com/boiteasite\n# Software Link: https://github.com/boiteasite/cmsuno\n# Affected Version(s): CMSuno 1.7 (and prior)\n# CVE : CVE-2021-36654\n\nCMSuno version 1.7 and prior is vulnerable to a stored cross-site scripting.\n\nThe attacker must be authenticated to exploit the vulnerability.\n\nThe payload injection is done while updating the template's image filename, vulnerable parameter is *tgo*\n\nSteps to reproduce:\n\n1. Go to /uno.php and click on *plugins*\n2. Click on *Logo*\n3. Choose a random picture in your files repo, click on save and intercept the request\n4. Edit the POST request to /uno/template/uno1/uno1.php by modifying the tgo parameter's value to \")}\n5. Forward the request and click on *publish*\n6. Click on *See the website*\n7. XSS\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:04.608073Z"}