CVE-2016-4875 Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataBox plugin before 0.0.0.20160906, and (3) userBox plugin before 0.0.0.20160906 for...
MediumCVSS 6.1
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataBox plugin before 0.0.0.20160906, and (3) userBox plugin before 0.0.0.20160906 for Geeklog allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| assist project assist plugin | <= 1.1.0 | No fix listed |
| databox project databox plugin | <= 0..0.0.20150609 | No fix listed |
| userbox project userbox plugin | <= 0.0.0.20150918 | No fix listed |
References
- JVN#46087986 third-party-advisory vdb-entry
- JVNDB-2016-000167 third-party-advisory vdb-entry
- 93123 third-party-advisory vdb-entry
- github.com patch third-party-advisory
- github.com patch third-party-advisory