En bref
- CVE-2020-36395 est une vulnérabilité MOYENNE (CVSS 5.4) touchant lavalite/cms, lavalite (lavalite).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.51%, plus élevée que 43.8% des vulnérabilités.
- Correctif : mettre à jour vers 5.8.0 ou plus récent.
Description
A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
NVD description
A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free