Description
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Remediation
References
Related Vulnerabilities
WordPress Incorrect Authorization Vulnerability (CVE-2017-6816)
PHP Numeric Errors Vulnerability (CVE-2007-2872)
MySQL Resource Management Errors Vulnerability (CVE-2010-3678)
PHP Improper Input Validation Vulnerability (CVE-2015-5589)
Liferay Portal Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-10795)