Description
A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add info block".
Remediation
References
Related Vulnerabilities
Python Improper Neutralization of CRLF Sequences ('CRLF Injection') Vulnerability (CVE-2019-9947)
PHP Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2006-4812)
WordPress Plugin WordPress Download Manager 'cid' Parameter Cross-Site Scripting (2.2.2)