Description

An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags.

Remediation

References

CVE-2020-12438

Related Vulnerabilities

Ruby on Rails Improper Access Control Vulnerability (CVE-2015-7577)

WordPress Plugin Redirection Cross-Site Request Forgery (1.1.3)

Oracle Database Server CVE-2005-4884 Vulnerability (CVE-2005-4884)

Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-0594)

WordPress Plugin Easy Digital Downloads-Simple eCommerce for Selling Digital Files Cross-Site Scripting (2.3.6)

Severity

Medium

Classification

CVE-2020-12438 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities