CVE-2020-23754

Опубликовано: 02 нояб. 2021

Источник: nvd

CVSS3: 9.6

CVSS2: 6.8

EPSS Низкий

Описание

Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via the polls feature.

Ссылки

https://github.com/php-fusion/PHP-Fusion/issues/2315
Broken Link
https://user-images.githubusercontent.com/62001260/81574006-6fb70480-93cf-11ea-814c-55a96d2fe95e.PNG
Third Party Advisory
https://user-images.githubusercontent.com/62001260/81574112-9412e100-93cf-11ea-9493-615a70162034.PNG
Third Party Advisory
https://github.com/php-fusion/PHP-Fusion/issues/2315
Broken Link
https://user-images.githubusercontent.com/62001260/81574006-6fb70480-93cf-11ea-814c-55a96d2fe95e.PNG
Third Party Advisory
https://user-images.githubusercontent.com/62001260/81574112-9412e100-93cf-11ea-9493-615a70162034.PNG
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:php-fusion:phpfusion:9.03.50:*:*:*:*:*:*:*

EPSS

Процентиль: 74%

0.0081

Низкий

9.6 Critical

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-j7xg-fp64-53cg

github

больше 3 лет назад