CVE-2020-10191

An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/controllers/client.php:detail...

CVE-2020-10191

CVE-2020-10191 affects MunkiReport before 5.3.0. An authenticated actor can inject a custom XSS payload via the /module/comment/save endpoint, with the payload executed by any authenticated user browsing the app (affecting app/controllers/client.php:detail). The issue is mitigated by upgrading to...

CVE-2020-10192

An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/brokenclient endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/views/listings/default.php...

CVE-2020-10192

An unauthenticated attacker can inject a cross-site scripting payload via the /report/broken_client endpoint in Munkireport versions prior to 5.3.0.3923. The payload is executed by any authenticated users visiting the application, affecting the vulnerability surface through app/views/listings/def...