Description
An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (disable_choose) passed to the "concrete5-legacy-master/web/concrete/tools/files/search_dialog.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Remediation
References
Related Vulnerabilities
MySQL CVE-2013-2378 Vulnerability (CVE-2013-2378)
Oracle Database Server CVE-2014-6467 Vulnerability (CVE-2014-6467)
WordPress Plugin WP Advanced Comment Cross-Site Scripting (0.10)
WordPress Plugin Export any WordPress data to XML/CSV Cross-Site Scripting (1.3.0)
Serendipity Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-5475)