This website uses cookies We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. You consent to our cookies if you continue to use our website. Show details Allow all cookies Use necessary cookies only EXPLOIT DATABASE EXPLOITS GHDB PAPERS SHELLCODES SEARCH EDB SEARCHSPLOIT MANUAL SUBMISSIONS ONLINE TRAINING PodcastGenerator 3.2.9 - Stored XSS EDB-ID: 52677 CVE: 2025-70336 EDB Verified: Author: SAHIL ARYA Type: WEBAPPS Exploit: / Platform: MULTIPLE Date: 2026-09-02 Vulnerable App: # Exploit Title: PodcastGenerator 3.2.9 - Stored XSS # Date: 2026-08-08 # Exploit Author: Sahil Arya # Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator # Software Link: https://github.com/PodcastGenerator/PodcastGenerator # Version: 3.2.9 # Tested on: Windows 11 / XAMPP # CVE : CVE-2025-70336 Description: PodcastGenerator 3.2.9 contains a stored Cross-Site Scripting vulnerability in the Live Items functionality. An authenticated administrator can inject JavaScript through the TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION parameters. The payload is stored and subsequently executed when the Live Item is rendered in both the administrative Live Items listing and the public Live Stream page. Administrative privileges are required only to store the payload. Unauthenticated access is sufficient to trigger the stored payload through the public Live Stream page. Proof of Concept: 1. Log in to the PodcastGenerator administrator panel. 2. Navigate to: /admin/live_create.php 3. Insert the following payload into TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION: <script>alert(document.domain)</script> 4. Save the Live Item. 5. Navigate to: /admin/live_list.php The JavaScript payload executes. 6. Open the public Live Stream page as an unauthenticated user: /live.php 7. The same stored payload executes in the visitor's browser. References: CVE: https://www.cve.org/CVERecord?id=CVE-2025-70336 NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-70336 Advisory: https://github.com/aryasahil96-manu/CVE-Disclosures/blob/main/CVE-2025-70336 Copy Tags: Advisory/Source: Link Databases Links Sites Solutions Exploits Search Exploit-DB OffSec Courses and Certifications Google Hacking Submit Entry Kali Linux Learn Subscriptions Papers SearchSploit Manual VulnHub OffSec Cyber Range Shellcodes Exploit Statistics Proving Grounds Penetration Testing Services EXPLOIT DATABASE BY OFFSEC TERMS PRIVACY ABOUT US FAQ COOKIES © OffSec Services Limited 2026. All rights reserved.