Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-7138)

Description

Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Remediation

References

CVE-2016-7138

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-36131)

WordPress 5.7.x PHP Object Injection (5.7 - 5.7.1)

WordPress Plugin WP Mapa Politico Espana Cross-Site Scripting (3.6.2)

MyBB Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2017-8104)

WordPress 4.2.x Cross-Site Scripting Vulnerability (4.2 - 4.2.7)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N