Serverstatus
Monthly
Stored cross-site scripting in stilleshan ServerStatus 1.0 and 2.0 allows a remote authenticated attacker to inject malicious JavaScript via the `custom` argument processed in the Stats Generation component (server/src/main.cpp). When an administrator or other user subsequently views the affected stats page, the stored payload executes in their browser session, enabling session hijacking or credential theft. A public proof-of-concept exploit exists as a documented PDF on GitHub; the vendor did not respond to coordinated disclosure.
Stored cross-site scripting in stilleshan ServerStatus 1.0 and 2.0 allows a remote authenticated attacker to inject malicious JavaScript via the `custom` argument processed in the Stats Generation component (server/src/main.cpp). When an administrator or other user subsequently views the affected stats page, the stored payload executes in their browser session, enabling session hijacking or credential theft. A public proof-of-concept exploit exists as a documented PDF on GitHub; the vendor did not respond to coordinated disclosure.