Cross-Site Scripting in WUZHI CMS by WUZHI Tech
CVE-2018-16349

6.1MEDIUM

Key Information:

Vendor

Wuzhi Cms Project

Status
Wuzhi Cms
Vendor
CVE Published:
2 September 2018

What is CVE-2018-16349?

WUZHI CMS version 4.1.0 is susceptible to Cross-Site Scripting (XSS) due to improper handling of user input through the 'remark' parameter in the add link form. This flaw could allow an attacker to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions. It is vital for users of this CMS to implement security measures to mitigate the risk of exploitation.

References

https://github.com/wuzhicms/wuzhicms/issues/147
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.