Description

Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gName parameter in single_pages/dashboard/users/groups/bulkupdate.php or (2) instance_id parameter in tools/dashboard/sitemap_drag_request.php.

Remediation

References

CVE-2014-9526

Related Vulnerabilities

Oracle Application Server Other Vulnerability (CVE-2007-0281)

MySQL CVE-2021-2021 Vulnerability (CVE-2021-2021)

Oracle Application Server Credentials Management Errors Vulnerability (CVE-2004-1366)

Moodle Improper Access Control Vulnerability (CVE-2015-2267)

WordPress Plugin Custom Metas Cross-Site Scripting (1.5.1)

Severity

Medium

Classification

CVE-2014-9526 CWE-707

Tags

Missing Update Known Vulnerabilities