Описание
Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via a URL encoded expression in the query string in (1) index.php and (2) possibly certain other scripts, which is not properly cleansed when accessed from the $_SERVER['PHP_SELF'] variable.
Ссылки
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:hivemail:hivemail:1.1:*:*:*:*:*:*:*
cpe:2.3:a:hivemail:hivemail:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:hivemail:hivemail:1.2:*:*:*:*:*:*:*
cpe:2.3:a:hivemail:hivemail:1.2.1_beta1:*:*:*:*:*:*:*
cpe:2.3:a:hivemail:hivemail:1.2.1_rc:*:*:*:*:*:*:*
cpe:2.3:a:hivemail:hivemail:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:hivemail:hivemail:1.2_sp1:*:*:*:*:*:*:*
cpe:2.3:a:hivemail:hivemail:1.3:*:*:*:*:*:*:*
cpe:2.3:a:hivemail:hivemail:1.3_beta1:*:*:*:*:*:*:*
cpe:2.3:a:hivemail:hivemail:1.3_rc1:*:*:*:*:*:*:*
EPSS
Процентиль: 73%
0.00771
Низкий
4.3 Medium
CVSS2
Дефекты
NVD-CWE-Other
Связанные уязвимости
github
почти 4 года назад
Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via a URL encoded expression in the query string in (1) index.php and (2) possibly certain other scripts, which is not properly cleansed when accessed from the $_SERVER['PHP_SELF'] variable.
EPSS
Процентиль: 73%
0.00771
Низкий
4.3 Medium
CVSS2
Дефекты
NVD-CWE-Other