Description

Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Remediation

References

CVE-2016-7140

Related Vulnerabilities

Oracle HTTP Server Exposure of Resource to Wrong Sphere Vulnerability (CVE-2022-25236)

WordPress Plugin Rich Reviews Multiple Vulnerabilities (1.7.3)

WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2018-3245)

WordPress Plugin Anti-Malware Security and Brute-Force Firewall Cross-Site Scripting (4.15.22)

Moodle Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2015-1493)

Severity

Medium

Classification

CVE-2016-7140 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities