Exploit for htmly 2.9.9 Cross Site Scripting

## https://sploitus.com/exploit?id=PACKETSTORM:181663
# Exploit Title: Stored XSS in "Edit Profile" - htmlyv2.9.9  
# Date: 9/2024  
# Exploit Author: Andrey Stoykov  
# Version: 2.9.9  
# Tested on: Ubuntu 22.04  
# Blog:  
https://msecureltd.blogspot.com/2024/09/friday-fun-pentest-series-11-stored-xss.html  
  
  
Stored XSS #1:  
  
Steps to Reproduce:  
  
1. Login as author  
2. Browse to "Edit Profile"  
3. In "Content" field add payload "><img src=x onerror=alert(1)>  
4. Then refresh the "Edit Profile" page  
  
  
# Exploit Title: Stored XSS in "Menu Editor" - htmlyv2.9.9  
# Date: 9/2024  
# Exploit Author: Andrey Stoykov  
# Version: 2.9.9  
# Tested on: Ubuntu 22.04  
# Blog:  
https://msecureltd.blogspot.com/2024/09/friday-fun-pentest-series-10-stored-xss.html  
  
  
Stored XSS #1:  
  
Steps to Reproduce:  
  
1. Login as admin  
2. Browse to "Menu Editor"  
3. In "Name" field add payload "><img src=x onerror=alert(1)>  
4. In "Slug" field add payload "><img src=x onerror=alert(1)>  
5. Click "Save Edit" > "Save Menu"