Two bypass techniques in NukeViet's Core Request class allow stored XSS in the News module. First, the filterAttr() method fails to strip ASCII Form Feed characters (\x0C) before checking for event handler attributes, allowing an attacker to prefix event handlers (e.g., \x0Conerror) that bypass the /^on/i regex but still execute in browsers. Second, unhtmlentities() strips hex-encoded tabs but not decimal HTML entity tabs (	), allowing javascript: URIs with embedded decimal tab entities to bypass keyword blocking and execute. These flaws permit low-privileged users with news-posting rights to store arbitrary JavaScript that executes in any user's browser viewing the affected content. The issue is fixed by stripping all ASCII control characters from attribute names before filtering and removing decimal HTML entities for control characters before keyword checks.

An authenticated attacker with permission to post news can inject persistent JavaScript payloads that execute in the browsers of any users viewing the affected news articles, including administrators. This enables theft of session cookies, credential harvesting, content defacement, and potential further privilege escalation within the application.

A patch is available that fixes the vulnerabilities by enhancing input filtering in the Core Request class. Specifically, it strips all ASCII control characters from attribute names before event handler detection and removes decimal HTML entities for control characters before keyword filtering. Users should update to NukeViet version 4.6.00 or later to apply these fixes. No workarounds are available.