vendor:
Workout Journal App
by:
MURAT CAGRI ALIS
6.1
CVSS
HIGH
Stored Cross-Site Scripting (XSS)
79
CWE
Product Name: Workout Journal App
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE: CVE-2024-24050
CPE: a:workout_journal_app:workout_journal_app:1.0
Platforms Tested: Windows, MacOS, Linux
2024
Workout Journal App 1.0 – Stored XSS
The Workout Journal App version 1.0 is vulnerable to stored XSS. By registering with malicious XSS payloads in the First and Last name fields during registration, an attacker can execute arbitrary scripts. This vulnerability arises due to lack of data validation, allowing the browser to execute injected code.
Mitigation:
To mitigate this vulnerability, input validation and output encoding should be implemented to prevent the execution of scripts entered by users. Additionally, sanitizing user inputs and encoding output data can help prevent stored XSS attacks.