In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks.
References
Link | Resource |
---|---|
http://vfairs.com | Vendor Advisory |
https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack | Third Party Advisory |
Configurations
History
No history.
Information
Published : 2021-05-26 12:15
Updated : 2024-02-28 18:28
NVD link : CVE-2020-26680
Mitre link : CVE-2020-26680
CVE.ORG link : CVE-2020-26680
JSON object : View
Products Affected
vfairs
- vfairs
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')