Description

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.

Remediation

References

CVE-2012-4246

Related Vulnerabilities

PostgreSQL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2021-32027)

Sqlite Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-6607)

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9407)

LimeSurvey Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2021-44967)

WordPress Plugin Lightweight Sidebar Manager Cross-Site Request Forgery (1.1.4)

Severity

Medium

Classification

CVE-2012-4246 CWE-707

Tags

Missing Update Known Vulnerabilities