Description
A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Group".
Remediation
References
Related Vulnerabilities
WordPress Plugin miniOrange Discord Integration Security Bypass (2.1.5)
Moodle Uncontrolled Resource Consumption Vulnerability (CVE-2020-25630)
WordPress Plugin YITH Desktop Notifications for WooCommerce Security Bypass (1.2.7)
WordPress Plugin Content Copy Protection & Prevent Image Save Cross-Site Request Forgery (1.3)