PHPEMS Content Section api.cls.php cross site scripting
CVE-2023-6472

4.8MEDIUM

Key Information:

Vendor

PHPems

Status
PHPEMS
Vendor
CVE Published:
2 December 2023

What is CVE-2023-6472?

A vulnerability, which was classified as problematic, has been found in PHPEMS 7.0. This issue affects some unknown processing of the file app\content\cls\api.cls.php of the component Content Section Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246629 was assigned to this vulnerability.

Affected Version(s)

PHPEMS 7.0

References

https://vuldb.com/?id.246629
vdb-entry
https://vuldb.com/?ctiid.246629
signaturepermissions-required
https://www.yuque.com/u39339523/el4dxs/vs8kw5gql9646xx4
exploit

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.