Stored XSS in admin panel "notes" field allows session takeover

Summary#

This is an EXAMPLE advisory used to demonstrate the format. ExampleCo is fictional.

The notes field on customer records is rendered with innerHTML in the admin view without output encoding. Input is length-limited but not sanitized server-side.

Impact#

Script runs in the admin origin. Because the session cookie lacks HttpOnly, an attacker can capture an administrator session and perform any admin action, including creating new admin accounts.

Technical details#

// admin/views/record.js — vulnerable sink
const el = document.querySelector('#notes');
el.innerHTML = record.notes;   // unencoded user input

Reproduction (sanitized)#

1. Sign in as any user with the Support role.
2. Edit a customer record and save a benign marker payload in notes, e.g. <img src=x onerror=console.log(1)>.
3. As an administrator, open the record. The handler fires in the admin origin.

Remediation#

References#

• CWE-79: Improper Neutralization of Input During Web Page Generation
• OWASP Cross-Site Scripting Prevention Cheat Sheet
• FIRST CVSS v4.0 Specification

Timeline#

• 2026-08-03Identified during engagement
• 2026-08-04Reported to vendor via Breachvane
• 2026-09-12Fix released (4.2.1)
• 2026-09-20Retest passed
• 2026-10-14Advisory published

Cite this advisory#