CVE-2015-5520

2015-07-1416:00:00

mitre

www.cve.org

cross-site scripting

orchard

users module

cve-2015-5520

remote attackers

arbitrary web script

html

user account creation

account deletion

AI Score

5.7

Confidence

High

EPSS

0.005

Percentile

76.3%

JSON

Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account.