Design/Logic Flaw

DISPUTED An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml&name=homecontent allows XSS via the HTML Source Editor. NOTE: the vendor disputes this because the form requires administrator privileges, and entering JavaScript is supported functionality...

CVE-2018-18290

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml&name=homecontent allows XSS via the HTML Source Editor. NOTE: the vendor disputes this because the form requires administrator privileges, and entering JavaScript is supported functionality...

CVE-2018-18290

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml&name=homecontent allows XSS via the HTML Source Editor. NOTE: the vendor disputes this because the form requires administrator privileges, and entering JavaScript is supported functionality...

PT-2018-14394 · Nc Cms · Nc-Cms

Name of the Vulnerable Software and Affected Versions: nc-cms versions through 2017-03-10 Description: An issue was discovered that allows XSS via the HTML Source Editor in the "index.php?action=edit html&name=home content" endpoint. The vendor disputes this issue because the form requires...

CVE-2018-18290: Improper Neutralization of Input During Web Page Generation

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml&name=homecontent allows XSS via the HTML Source Editor. NOTE: the vendor disputes this because the form requires administrator privileges, and entering JavaScript is supported functionality...