GitHub Advisoryadvisory · Packagist

GHSA-f5jh-q6mp-9c8p ImpressCMS Cross-site scripting Vulnerability

MEDIUM Published 2022-05-17 Modified 2023-08-16 Official page ↗
Aliases
CVE-2014-4036
Ecosystem
Packagist
Packages
impresscms/impresscms
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2023-08-16

Affected packages

• Packagist impresscms/impresscms: <= 1.3.6.1 (no fix yet)

Description

A cross-site scripting (XSS) vulnerability in `modules/system/admin.php` in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a listimg action.

Related

Alias · CVE (1)

  • CVE-2014-4036 Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References