RSS   Podatności dla 'Syguestbook a5'   RSS

2019-07-18
 
CVE-2019-13950

CWE-79
 

 
index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment.

 
 
CVE-2019-13949

CWE-352
 

 
SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change.

 
 
CVE-2019-13948

CWE-79
 

 
SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by a crafted use of the onerror attribute of an IMG element.

 


Copyright 2024, cxsecurity.com

 

Back to Top