CVE-2021-25875

Опубликовано: 01 нояб. 2021

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.

Ссылки

http://avideoyouphptube.com
Broken Link
Product
URL Repurposed
https://synacktiv.com
Product
https://www.synacktiv.com/sites/default/files/2021-01/YouPHPTube_Multiple_Vulnerabilities.pdf
Exploit
Vendor Advisory
http://avideoyouphptube.com
Broken Link
Product
URL Repurposed
https://synacktiv.com
Product
https://www.synacktiv.com/sites/default/files/2021-01/YouPHPTube_Multiple_Vulnerabilities.pdf
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:youphptube:youphptube:*:*:*:*:*:*:*:*

Версия до 10.0 (включая)

EPSS

Процентиль: 62%

0.00435

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-mx3c-jcgc-cjwv

github

больше 3 лет назад