Description

Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.

Remediation

References

CVE-2015-3989

Related Vulnerabilities

WordPress Other Vulnerability (CVE-2007-3240)

IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-1524)

Apache Tomcat version older than 6.0.36

WordPress Plugin Shortlinks by Pretty Links-Best WordPress Link Tracking 'slug' Parameter Cross-Site Scripting (1.5.5)

WordPress Plugin Backup and Staging by WP Time Capsule PHP Object Injection (1.21.9)

Severity

Medium

Classification

CVE-2015-3989 CWE-707

Tags

Missing Update Known Vulnerabilities