Description
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Remediation
References
Related Vulnerabilities
Drupal Core 9.0.x Arbitrary File Overwrite (9.0.0 - 9.0.10)
WordPress Plugin Visual Form Builder Multiple Cross-Site Scripting Vulnerabilities (2.8.6)
markdown-it Inefficient Regular Expression Complexity Vulnerability (CVE-2015-10005)
WordPress Plugin Event List SQL Injection (0.7.8)
Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2026-33007)