CVE-2021-24495CWE-79

Marmoset Viewer < 1.9.3 - Reflected Cross Site Scripting

18Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendepss 3.3%

probabilidade de exploração

3.3%top 12% das CVEs

exploração observada

nãonenhuma fonte reporta

The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue.

Produtos afetados

Unknown · Marmoset Viewer

Referências

https://johnjhacking.com/blog/cve-2021-24495-improper-neutralization-of-input-during-web-page-generation-on-id-parameter-in-wordpress-marmoset-viewer-plugin-versions-1.9.3-leads-to-reflected-cross-site-scripting/https://wpscan.com/vulnerability/d11b79a3-f762-49ab-b7c8-3174624d7638