Cross-Site Scripting Vulnerability in Subrion CMS by Intelliants
CVE-2019-11406

6.1MEDIUM

Key Information:

Vendor

Intelliants

Status
Subrion Cms
Vendor
CVE Published:
8 May 2019

What is CVE-2019-11406?

Subrion CMS version 4.2.1 contains a cross-site scripting (XSS) vulnerability in the core contacts component. The flaw allows attackers to inject malicious scripts via the 'name', 'email', or 'phone' parameters, which may lead to unauthorized actions or information disclosure. Proper sanitization and validation of user inputs are essential to mitigate this vulnerability.

References

https://github.com/intelliants/subrion/commits/develop
x_refsource_MISC
https://github.com/intelliants/subrion/issues/821
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.