Stored XSS Vulnerability in PHPok by QingGan
CVE-2018-20006

6.1MEDIUM

Key Information:

Vendor

PHPok

Status
PHPok
Vendor
CVE Published:
10 December 2018

What is CVE-2018-20006?

A vulnerability exists in PHPok v5.0.055 that allows for Stored Cross-Site Scripting through the title parameter when saving posts via the api.php endpoint. Attackers can exploit this by sending malicious scripts, which will then be executed in the context of users visiting affected web applications, presenting significant security risks.

References

https://github.com/qinggan/phpok/issues/3
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.