CVE-2015-9545

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.

• CWE-20

• https://github.com/ofirdagan/cross-domain-local-storageProduct, Third Party Advisory
• https://github.com/ofirdagan/cross-domain-local-storage/issues/17Patch, Third Party Advisory
• https://github.com/ofirdagan/cross-domain-local-storage/pull/19Patch, Third Party Advisory
• https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-Origin-ClientExploit, Third Party Advisory
• https://github.com/ofirdagan/cross-domain-local-storageProduct, Third Party Advisory
• https://github.com/ofirdagan/cross-domain-local-storage/issues/17Patch, Third Party Advisory
• https://github.com/ofirdagan/cross-domain-local-storage/pull/19Patch, Third Party Advisory
• https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-Origin-ClientExploit, Third Party Advisory

Published

Apr 7, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-9539The Fast Secure Contact Form plugin before 4.0.38 for WordPr…6.1
• CVE-2015-9540Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url…6.1
• CVE-2015-9541Qt through 5.14 allows an exponential XML entity expansion a…7.5
• CVE-2015-9542add_password in pam_radius_auth.c in pam_radius 1.4.0 does n…7.5
• CVE-2015-9543An issue was discovered in OpenStack Nova before 18.2.4, 19.…3.3
• CVE-2015-9544An issue was discovered in xdLocalStorage through 2.0.5. The…7.1
• CVE-2015-9546An issue was discovered on Samsung mobile devices with KK(4.…4.8
• CVE-2015-9547An issue was discovered on Samsung mobile devices with JBP(4…7.5
• CVE-2015-9548An issue was discovered in Mattermost Server before 1.2.0. I…7.5
• CVE-2015-9549A reflected Cross-site Scripting (XSS) vulnerability exists …6.1
• CVE-2015-9550An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B…7.5
• CVE-2015-9551An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B…9.8