CVE-2020-35582

🗓️ 15 Jan 2021 06:24:49Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 71 Views🌐 WEB

A stored XSS in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2020-35582	15 Jan 202112:50	–	circl
CNNVD	Envira Gallery Lite Cross-Site Scripting Vulnerability	13 Jan 202100:00	–	cnnvd
Cvelist	CVE-2020-35582	15 Jan 202106:24	–	cvelist
EUVD	EUVD-2020-23248	7 Oct 202500:30	–	euvd
NVD	CVE-2020-35582	15 Jan 202107:15	–	nvd
OpenVAS	WordPress Envira Photo Gallery Plugin < 1.8.3.3 Multiple Vulnerabilities	19 Mar 202100:00	–	openvas
Packet Storm	Envira Gallery Lite 1.8.3.2 Cross Site Scripting	13 Jan 202100:00	–	packetstorm
Prion	Cross site scripting	15 Jan 202107:15	–	prion
RedhatCVE	CVE-2020-35582	22 May 202515:31	–	redhatcve

NVD

Node

Source	Link
github	www.github.com/enviragallery/envira-gallery-lite/commit/102651514e6faca914ec1c7e113def340d8e1e09
github	www.github.com/enviragallery/envira-gallery-lite/blob/master/changelog.txt
github	www.github.com/enviragallery/envira-gallery-lite/commit/3b081dd10a1731f8cd981bebeac0e775fb217acf
packetstormsecurity	www.packetstormsecurity.com/files/160924/Envira-Gallery-Lite-1.8.3.2-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
post_title	request body	wp-admin/post.php	Stored XSS via post_title in Envira Gallery Lite (CVE-2020-35582).	CWE-79
meta[title]	request body	wp-admin/admin-ajax.php	Stored XSS via meta[title] in admin-ajax endpoint.	CWE-79

21 Nov 2024 05:27Current

5.2Medium risk

Vulners AI Score5.2

CVSS 23.5

CVSS 3.15.4

EPSS0.00471