Cross site scripting

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...

CVE-2018-18782: Improper Neutralization of Input During Web Page Generation

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...

PT-2018-14646

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description A reflected XSS issue exists due to the "ftype" parameter in the "/member/myfriend.php" API endpoint. Recommendations For DedeCMS version 5.7 SP2, consider restricting access to the "/member/myfriend.php"...