CVE-2020-5298

MEDIUM Year: 2020
CVSS v3 Score
4.8
Medium
CVSS v2 Score
3.5
Low
Weakness Type
CWE-87
View all →

Vulnerability Description

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).

Related Vulnerabilities

CVE-2023-20188

MEDIUM
CVSS:4.8(Medium)

A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable...

CWE-872023

CVE-2023-20208

MEDIUM
CVSS:4.8(Medium)

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an aff...

CWE-872023

CVE-2021-40131

MEDIUM
CVSS:5.4(Medium)

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack ag...

CWE-872021

CVE-2022-20963

MEDIUM
CVSS:5.4(Medium)

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a use...

CWE-872022

CVE-2024-25640

MEDIUM
CVSS:5.4(Medium)

Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, af...

CWE-872024

CVE-2024-3162

MEDIUM
CVSS:5.4(Medium)

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all versions up to, and including, 2.6.3 due to insufficient input sani...

CWE-872024