Description
A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add".
Remediation
References
Related Vulnerabilities
Apache HTTP Server Other Vulnerability (CVE-1999-0067)
Next.js URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2020-15242)
WordPress Plugin Tutor LMS-eLearning and online course solution Cross-Site Scripting (1.9.11)
WordPress Plugin Google Alert And Twitter Multiple Vulnerabilities (3.1.5)
WordPress Plugin Backup and Restore WordPress-WPBackItUp Cross-Site Request Forgery (1.6.7)