Bug on www.360cities.net krpano embedding script

[JesusSavedMe]

Hi 

The KRPano JS used in site seems to be vulnerable to XSS execution.
URL to Reproduce : 
Browse : https://www.360cities.net/?xml=https://files.catbox.moe/8u3vhd.xml
And wait till loaded

Current KRPano Version: krpano 1.20.11
Updating krpano Embedding Script might fix the issue

Hoping that you mitigate it sooner as

Cross-Site Scripting (XSS) risks include:

1. Session Hijacking: Attackers steal session cookies, impersonating users and gaining unauthorized access.
2. Credential Theft: XSS can steal login details, allowing attackers to take over accounts.
3. Website Defacement: Attackers modify a website's appearance, damaging its reputation.
4. Malicious Redirects: Users are redirected to phishing or malware sites.
5. Data Theft: Sensitive data, like personal information or credit card details, can be stolen.
6. Malware Distribution: XSS can inject malware onto users' devices.
7. Privilege Escalation: Attackers may gain admin access to systems or sensitive areas.
8. Denial of Service (DoS): XSS can cause browsers or servers to crash or slow down.
9. Loss of Trust: Affected sites lose user trust, impacting reputation and business.

Regards
JesusSavedMe

[Elena Martinez]

Hello  JesusSavedMe,

Thanks for your report. We'll update krpano.

Regards,

Elena