Description

Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.

Remediation

References

CVE-2015-3989

Related Vulnerabilities

Django Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-0697)

ReviveAdserver Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Vulnerability (CVE-2019-5440)

Oracle Database Server CVE-2020-2515 Vulnerability (CVE-2020-2515)

WordPress Plugin Booster for WooCommerce PHP Object Injection (3.0.1)

WordPress Plugin AccessPress Social Icons includes Backdoor [Only if downloaded via the vendor website] (1.8.2)

Severity

Medium

Classification

CVE-2015-3989 CWE-707

Tags

Missing Update Known Vulnerabilities