Showdoc 2.10.3 Stored Cross-Site Scripting (XSS)

CVE Category Price Severity
CVE-2022-0967 CWE-79 $500 High
Author Risk Exploitation Type Date
Unknown High Remote 2022-05-17
Please visit the URL provided and locate the CVSS score associated with the exploit. 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at:

Below is a copy:

Showdoc 2.10.3 Stored Cross-Site Scripting (XSS)
# Exploit Title: Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
# Exploit Author: Akshay Ravi
# Vendor Homepage:
# Software Link:
# Version: <= 2.10.3
# Tested on: macOS Monterey
# CVE : CVE-2022-0967

Description: Stored XSS via uploading file in .ofd format

1. Create a file with .ofd extension and add XSS Payload inside the file

filename = "payload.ofd"
payload = "<script>alert(1)</script>"

2. Login to showdoc v2.10.2 and go to file library

Endpoint = ""

3. Upload the payload on file library and click on the check button
4. The XSS payload will executed once we visited the URL

Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum