Summary

Uptime Kuma status page allows persistent XSS.

PoC

1. Run Uptime Kuma with version 1.19.2
2. Create a new status page.
3. Edit a status page and enter the following payload into "description": "><script>alert('XSS in description discovered by Manuel')</script>
4. Press "Save" --> The payload is executed.
5. The payload is also executed when you select the this status page.

Impact

https://cwe.mitre.org/data/definitions/79.html

Screenshots