Multiple cross-site scripting (XSS) vulnerabilities in Geeklog IVYWE edition 2.1.1 allow remote attackers to inject arbitrary web script or HTML by leveraging use of the COM_getCurrentURL function in (1) public_html/layout/default/header.thtml, (2) public_html/layout/bento/header.thtml, (3) public_html/layout/fotos/header.thtml, or (4) public_html/layout/default/article/article.thtml.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: jpcert
Published: 2017-04-20T17:00:00
Updated: 2024-08-06T00:39:26.313Z
Reserved: 2016-05-17T00:00:00
Link: CVE-2016-4849
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2017-04-20T17:59:00.337
Modified: 2017-04-25T18:42:55.897
Link: CVE-2016-4849
Redhat
No data.