Cross-Site Scripting Vulnerability in Lexiglot by Just Another Hacker
CVE-2014-8944

5.4MEDIUM

Key Information:

Vendor

Piwigo

Status
Lexiglot
Vendor
CVE Published:
1 June 2020

What is CVE-2014-8944?

Lexiglot, a plugin for WordPress, is susceptible to cross-site scripting (XSS) attacks. These vulnerabilities allow an attacker to inject malicious scripts via the username field or to exploit certain parameters in the admin interface. Specifically, the parameters 'install_name', 'intro_message', and 'new_file_content' are points of injection. This can lead to both reflected and stored XSS, potentially compromising user data integrity and impacting the overall security of web applications utilizing this plugin.

References

https://www.justanotherhacker.com/2018/05/jahx181_-_piwig...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.