CVE-2015-5456 Cross-site scripting (XSS) vulnerability in the form method in modules/formclass.php in PivotX before 2.3.11 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO, related t...
MediumCVSS 4.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the form method in modules/formclass.php in PivotX before 2.3.11 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO, related to the "PHP_SELF" variable and form actions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotx | <= 2.3.10 | No fix listed |
References
- blog.pivotx.net
- packetstormsecurity.com exploit
- software-talk.org exploit
- sourceforge.net
- 20150627 Session Fixation, Reflected XSS, Code Execution in PivotX 2.3.10 mailing-list
- 75577 vdb-entry