Introduction

This article focuses on a stored XSS vulnerability we identified in ProjeQtOr.

«««< HEAD For more context about the software itself, I already covered that in the first article of this series: From login to admin : CVE-2026-41462 .

For more context about the software itself, I already covered that in the first article of this series: From login to admin : CVE-2026-41462 .

dev

This time, the vulnerable behavior was linked to HTML filtering. The application tried to detect dangerous HTML patterns, but the protection was not strong enough.

Introduction

This post covers another stored XSS vulnerability in ProjeQtOr, this time through file upload.

«««< HEAD I already introduced ProjeQtOr and why this kind of application can contain sensitive business data in the first article of the series: From login to admin : CVE-2026-41462 .

I already introduced ProjeQtOr and why this kind of application can contain sensitive business data in the first article of the series: From login to admin : CVE-2026-41462 .