PT-2018-17296

Name of the Vulnerable Software and Affected Versions: BigTree version 4.2.19 Description: The issue allows remote users to inject arbitrary web script or HTML via the directory parameter in the /core/admin/ajax/developer/extensions/file-browser.php API endpoint. This is a cross-site scripting XS...

CVE-2018-6013: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the directory parameter. This issue exists in core/admin/ajax/developer/extensions/file-browser.php...