Cross-Site Scripting Vulnerability in Blackcat CMS by Blackcat
CVE-2018-16635

5.4MEDIUM

Key Information:

Vendor

Blackcat-cms

Status
Blackcat Cms
Vendor
CVE Published:
10 December 2018

What is CVE-2018-16635?

Blackcat CMS version 1.3.2 is vulnerable to Cross-Site Scripting (XSS) due to improper handling of the page title parameter in the 'willkommen.php?lang=DE' endpoint located at backend/pages/modify.php. An attacker can exploit this vulnerability to inject malicious scripts into web pages, potentially affecting users who visit the compromised page. This can lead to unauthorized actions, session hijacking, and data theft, posing a significant risk to the security of web applications using this CMS.

References

https://github.com/security-breachlock/CVE-2018-16635/blo...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2018-16635 : Cross-Site Scripting Vulnerability in Blackcat CMS by Blackcat