Description

Cross-site scripting (XSS) vulnerability in the filemanager in b2evolution before 5.2.1 allows remote attackers to inject arbitrary web script or HTML via the fm_filter parameter to blogs/admin.php.

Remediation

References

CVE-2014-9599

Related Vulnerabilities

WordPress Plugin WPCOM Member Malicious Code (1.3.16)

WordPress Plugin GoDaddy Email Marketing Cross-Site Request Forgery (1.1.2)

Oracle Database Server CVE-2011-0882 Vulnerability (CVE-2011-0882)

WordPress Plugin WordPress Alipay/Tenpay/PayPal Cross-Site Scripting (3.6.0)

WordPress Plugin Search & Replace PHP Object Injection (3.2.2)

Severity

Medium

Classification

CVE-2014-9599 CWE-707

Tags

Missing Update Known Vulnerabilities