PT-2013-6294

Name of the Vulnerable Software and Affected Versions eFront version 3.6.14 build 18012 Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML via the Last name, Lesson name, or Course name field in the www/administrator.php file. This can be...

CVE-2013-7194: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in www/administrator.php in eFront 3.6.14 build 18012 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 Last name, 2 Lesson name, or 3 Course name field...

PT-2012-3039

Name of the Vulnerable Software and Affected Versions eFront Community++ edition version 3.6.10 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the filter parameter in the /www/administrator.php endpoint. This could potentially lead ...