CVE-2012-1979 Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the email parameter (aka Emai...
LowCVSS 3.5
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the email parameter (aka Email address field) in an edit_user configuration action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| syndeocms | <= 3.0.01 | No fix listed |
| syndeocms | = 2.4 | No fix listed |
| syndeocms | = 2.4.10 | No fix listed |
| syndeocms | = 2.5.00 | No fix listed |
| syndeocms | = 2.5.01 | No fix listed |
| syndeocms | = 2.6.00 | No fix listed |
| syndeocms | = 2.7.00 | No fix listed |
| syndeocms | = 2.8.00 | No fix listed |
| syndeocms | = 2.8.1 | No fix listed |
| syndeocms | = 2.8.02 | No fix listed |
| syndeocms | = 2.9.00 | No fix listed |
| syndeocms | = 3.0.00 | No fix listed |
References
- 80746 vdb-entry
- packetstormsecurity.org
- 18686 exploit
- 52840 vdb-entry
- www.webapp-security.com exploit
- syndeocms-index-xss(74545) vdb-entry