CVE-2021-24495CWE-79

Marmoset Viewer < 1.9.3 - Reflected Cross Site Scripting

18Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 3.3%

probabilidad de explotación

3.3%top 12% de las CVE

explotación observada

noninguna fuente lo reporta

The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue.

Productos afectados

Unknown · Marmoset Viewer

Referencias

https://johnjhacking.com/blog/cve-2021-24495-improper-neutralization-of-input-during-web-page-generation-on-id-parameter-in-wordpress-marmoset-viewer-plugin-versions-1.9.3-leads-to-reflected-cross-site-scripting/https://wpscan.com/vulnerability/d11b79a3-f762-49ab-b7c8-3174624d7638