Description

Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.

Remediation

References

CVE-2019-7541

Related Vulnerabilities

WordPress Plugin Facebook, Twitter & Google+ Social Widgets Multiple Vulnerabilities (1.3.7)

WordPress Plugin smart Archive Page Remove Unspecified Vulnerability (3)

WordPress Plugin Widget Settings Importer/Exporter Cross-Site Scripting (1.5.3)

WordPress Plugin Ultimate Maps by Supsystic SQL Injection (1.1.12)

XWikiplatform Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-37900)

Severity

Medium

Classification

CVE-2019-7541 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities