Cross-Site Scripting Vulnerabilities in OSClass by OSClass
CVE-2014-6280

Currently unrated

Key Information:

Vendor

Osclass

Status
Osclass
Vendor
CVE Published:
20 October 2014

What is CVE-2014-6280?

OSClass versions prior to 3.4.2 are subjected to multiple Cross-Site Scripting (XSS) vulnerabilities. These flaws allow remote attackers to inject arbitrary web scripts or HTML into the application through various parameters including 'action' and 'nsextt' on the oc-admin/index.php endpoint. Exploiting these vulnerabilities can lead to unauthorized access and manipulation of the user's session, potentially compromising sensitive data.

References

http://www.securityfocus.com/archive/1/533457/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://packetstormsecurity.com/files/128286/OsClass-3.4.1...
x_refsource_MISC
http://blog.osclass.org/2014/09/15/osclass-3-4-2-ready-do...
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.