Description

Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php

Remediation

References

CVE-2020-12706

Related Vulnerabilities

TYPO3 Use of Insufficiently Random Values Vulnerability (CVE-2010-3666)

WordPress Plugin Wp2android-webapp native mobile app builder free (android, IOs, Winphone mobile App) Arbitrary File Upload (1.1.4)

WordPress Plugin Display Users SQL Injection (2.0.0)

WordPress Plugin YITH WooCommerce Product Bundles Security Bypass (1.1.15)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-19217)

Severity

Medium

Classification

CVE-2020-12706 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities