cve/2020/CVE-2020-24901.md

### [CVE-2020-24901](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24901)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugin[test].url.

### POC

#### Reference
- https://packetstormsecurity.com/files/159477/Krpano-Panorama-Viewer-1.20.8-Cross-Site-Scripting.html
- https://packetstormsecurity.com/files/159477/Krpano-Panorama-Viewer-1.20.8-Cross-Site-Scripting.html

#### Github
No PoCs found on GitHub currently.