Description

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE.

Remediation

References

CVE-2013-4791

Related Vulnerabilities

Java Denial of Service (DoS) Vulnerability (CVE-2019-2762)

WordPress Plugin College publisher Import Arbitrary File Upload (0.1)

WordPress Plugin User Avatar TimThumb Arbitrary File Upload (1.3.7)

ReviveAdserver 7PK - Security Features Vulnerability (CVE-2016-9470)

WordPress Plugin Apocalypse Meow Security Bypass (21.2.7)

Severity

Medium

Classification

CVE-2013-4791 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities