A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/161562/LightCMS-1.3.4-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
| https://gist.github.com/Peithon/1c628ded0c4fc96c6331c3cce1d0c69b | Exploit Third Party Advisory |
| https://github.com/eddy8/LightCMS/issues/18 | Exploit Issue Tracking Third Party Advisory |
| https://www.exploit-db.com/exploits/49598 | Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/161562/LightCMS-1.3.4-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
| https://gist.github.com/Peithon/1c628ded0c4fc96c6331c3cce1d0c69b | Exploit Third Party Advisory |
| https://github.com/eddy8/LightCMS/issues/18 | Exploit Issue Tracking Third Party Advisory |
| https://www.exploit-db.com/exploits/49598 | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 06:21
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/161562/LightCMS-1.3.4-Cross-Site-Scripting.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://gist.github.com/Peithon/1c628ded0c4fc96c6331c3cce1d0c69b - Exploit, Third Party Advisory | |
| References | () https://github.com/eddy8/LightCMS/issues/18 - Exploit, Issue Tracking, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/49598 - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2021-02-24 15:15
Updated : 2024-11-21 06:21
NVD link : CVE-2021-3355
Mitre link : CVE-2021-3355
CVE.ORG link : CVE-2021-3355
JSON object : View
Products Affected
lightcms_project
- lightcms
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')