EUVD-2014-1035

Malware in sbrugna...

Cross site scripting

Cross-site scripting XSS vulnerability in Sitecore CMS before 7.0 Update-4 rev. 140120 allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI. NOTE: some of these details are obtained from third party information...

CVE-2014-100004

Sitecore CMS up to version 7.0 Update-4 (rev. 140120) is affected by an XSS in the handling of XML Controls exposed via the default URI’s xmlcontrol parameter. The vulnerability allows remote attackers to inject arbitrary web scripts or HTML, with the NVD description noting basic impact of cross-...