Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System
30Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.1
from disclosure to weapon0 days
Published on NVDSep 4
1st PoCSep 4
exploitation probability
—
observed exploitation
nono source reports it
1 public exploit(s)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing.
This issue affects Library Information and Document Automation Program: from v22.1 before v22.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. · Library Information and Document Automation Programpublic PoCs found — 1
githubgithub.com/alkimcoskun/Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.