NeDi 1.9C XSS

Published on
10 Jan 2022


Because of an incorrect implementation of sanitise() in inc/libmisc.php, NeDi 1.9C is vulnerable to XSS. This function tries to escape the SCRIPT tag from user-controllable values, however it can be quickly bypassed, as shown by an IMG element’s onerror attribute as a Devices-Config.php?sta= value.


  • Update NeDi 1.9C to the latest version
Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.
Find website security issues in a flash
Improve your website's security posture with proactive vulnerability detection.
Free website security assessment