CVE-2020-24390

eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/adminlogs page, which might allow pre-authentication stored XSS during login/logout logs recording...

CVE-2020-24390: Improper Neutralization of Input During Web Page Generation

eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/adminlogs page, which might allow pre-authentication stored XSS during login/logout logs recording...

ECSHOP存在XSS直打管理后台

简要描述： N久了,你们是修还是不修啊?这么蛋疼的一个漏洞. 详细说明： 先看adminlogs.php代码 define'INECS', true; requiredirnameFILE . '/includes/init.php'; / act操作项的初始化 / if empty$REQUEST'act' $REQUEST'act' = 'list'; else $REQUEST'act' = trim$REQUEST'act'; /------------------------------------------------------ / //-- 获取所有日志列表...