CVE-2018-11628

EPSS 3.5%

Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/44831/unverified exploitdbwww.exploit-db.com/exploits/44831unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://docs.emssoftware.com/Content/V44.1_ReleaseNotes.htm https://gist.github.com/barrett092/c70752ca6960b8b9616a03006f291a28 https://www.exploit-db.com/exploits/44831/http://www.securityfocus.com/bid/104428