Design/Logic Flaw

2017-02-1204:59:00

PRIOn knowledge base

www.prio-n.com

6.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.4%

JSON

An issue was discovered in ionize through 1.0.8. The vulnerability exists due to insufficient filtration of user-supplied data in the “path” HTTP GET parameter passed to the “ionize-master/themes/admin/javascript/tinymce/jscripts/tiny_mce/plugins/codemirror/dialog.php” URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.