CVE-2019-25311mediumCWE-79

CVE-2019-25311: falha de média gravidade em kostasmitroglou thesystem

thesystem Persistent XSS

Publicada em

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.2%
probabilidade de exploração
0.2%top 89% das CVEs
exploração observada
nãonenhuma fonte reporta
thesystem version 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple server data input fields. Attackers can submit crafted script payloads in operating_system, system_owner, system_username, system_password, system_description, and server_name parameters to execute arbitrary JavaScript in victim browsers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
kostasmitroglou · thesystem
CVEs relacionadas — kostasmitroglou thesystem

No mesmo produto, das mais perigosas para as menos.

CVE-2019-25441CRITICALthesystem 1.0 Command Injection via run_command endpointEPSS 8.4%CVE-2019-25347HIGHthesystem App 1.0 - 'username' SQL InjectionEPSS 0.5%CVE-2019-25346HIGHthesystem 1.0 - 'server_name' SQL InjectionEPSS 0.5%
Referências
https://github.com/kostasmitroglou/thesystemhttps://www.exploit-db.com/exploits/47440https://www.vulncheck.com/advisories/thesystem-persistent-xss