CVE-2015-1053

2015-01-1615:00:00

mitre

www.cve.org

AI Score

5.7

Confidence

High

EPSS

0.008

Percentile

81.6%

JSON

Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editfile.

References

packetstormsecurity.com/files/129916/CMS-Croogo-2.2.0-Cross-Site-Scripting.html

seclists.org/fulldisclosure/2015/Jan/24

sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-02.html

sroesemann.blogspot.de/2015/01/sroeadv-2015-02.html

www.securityfocus.com/bid/71999

blog.croogo.org/blog/croogo-221-released

exchange.xforce.ibmcloud.com/vulnerabilities/99890

github.com/croogo/croogo/issues/599