glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability. The value of the title request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. This input was echoed unmodified in the application's response.
References
| Link | Resource |
|---|---|
| https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/glfusion/XSS-Reflected | Exploit Third Party Advisory |
| https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/glfusion/XSS-Reflected | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 06:33
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/glfusion/XSS-Reflected - Exploit, Third Party Advisory |
Information
Published : 2022-09-29 03:15
Updated : 2024-11-21 06:33
NVD link : CVE-2021-45843
Mitre link : CVE-2021-45843
CVE.ORG link : CVE-2021-45843
JSON object : View
Products Affected
glfusion
- glfusion
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')