CVE-2018-16249
PoC —CVSS 3.0
4.8 medium
EPSS
<1%p43
Published
()
Modified
Description
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
- Vendors
- b3log
- Products
- symphony
- Weakness
- CWE-79
- Vector
- CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
In the news0 stories
No ingested article mentions this CVE yet.