CVE-2020-23373

Cross-site scripting XSS vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter...

CVE-2020-23373

CVE-2020-23373 affects NoneCMS v1.3.0, with an XSS in admin/nav/add.html. The underlying issue is that the name parameter can trigger injection of arbitrary script/HTML by remote authenticated attackers. Public details across CNVD/NVD OSV entries consistently describe the same vector and impact; ...

PT-2021-10893

Name of the Vulnerable Software and Affected Versions noneCMS version 1.3.0 Description A cross-site scripting XSS issue allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter in the admin/nav/add.html file. Recommendations For noneCMS version 1.3.0,...

CVE-2020-23373: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter...

CVE-2020-23376: Cross-Site Request Forgery (CSRF)

NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack...