Description
A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add info block".
Remediation
References
Related Vulnerabilities
WordPress Plugin WordPress Console Security Bypass (0.3.9)
Oracle JRE CVE-2013-5780 Vulnerability (CVE-2013-5780)
MySQL Use of Externally-Controlled Format String Vulnerability (CVE-2008-3963)
Django Improper Input Validation Vulnerability (CVE-2014-3730)
WordPress Plugin WooCommerce Product Feed Manager Security Bypass (2.2.3)