TLDR Tech / InfoSec
How to Get a 100% Conference Acceptance Rate, The Novee Way: A High-Severity CVE in Leading Call-for-Papers Software
Novee researchers found a stored XSS in pretalx that lets any registered user inject HTML or JavaScript into organizer search results and execute code in the organizer's browser on a matching query. The exploit uses an iframe srcdoc to bypass innerHTML script blocking and a same-origin uploaded .js file to satisfy CSP, then hijacks the organizer session and can permanently revoke superuser rights via authenticated GETs. An attacker can automate submissions, plant payloads in titles, and drive near-certain exploitation across many conferences using shared pretalx deployments.
Read the full story