CVEvulnerability
CVE-2018-12943
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-07-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-Site Scripting (XSS) vulnerability in every page that includes the "action" URL parameter in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter.
Affected configurations
• seeddms seeddms (< 5.1.8)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG Third Party Advisory
- https://www.contextis.com/resources/advisories/cve-2018-12943 Third Party Advisory
- https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG Third Party Advisory
- https://www.contextis.com/resources/advisories/cve-2018-12943 Third Party Advisory