Cross site scripting

2017-06-1206:29:00

PRIOn knowledge base

www.prio-n.com

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching a Home Template Edit Page action and entering the Navigation Title of a page that is scheduled for future publication (aka a pending page change).

CPENameOperatorVersion
bigtree_cmsle4.2.18

CPE	Name	Operator	Version
	bigtree_cms	le	4.2.18

References

github.com/bigtreecms/BigTree-CMS/issues/296