{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScript payload executes."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-09-30T15:15:23", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/XOOPS/XoopsCore25/commits/master"}, {"tags": ["x_refsource_MISC"], "url": "https://xoops.org/modules/publisher/"}, {"tags": ["x_refsource_MISC"], "url": "https://blog.nirajkhatiwada.com.np/cve-2019-16683-stored-cross-site-scripting/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-16683", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScript payload executes."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/XOOPS/XoopsCore25/commits/master", "refsource": "MISC", "url": "https://github.com/XOOPS/XoopsCore25/commits/master"}, {"name": "https://xoops.org/modules/publisher/", "refsource": "MISC", "url": "https://xoops.org/modules/publisher/"}, {"name": "https://blog.nirajkhatiwada.com.np/cve-2019-16683-stored-cross-site-scripting/", "refsource": "MISC", "url": "https://blog.nirajkhatiwada.com.np/cve-2019-16683-stored-cross-site-scripting/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T01:17:41.075Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/XOOPS/XoopsCore25/commits/master"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://xoops.org/modules/publisher/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.nirajkhatiwada.com.np/cve-2019-16683-stored-cross-site-scripting/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-16683", "datePublished": "2019-09-30T15:15:23", "dateReserved": "2019-09-22T00:00:00", "dateUpdated": "2024-08-05T01:17:41.075Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xoops:xoops:2.5.10:*:*:*:*:*:*:*", "matchCriteriaId": "0C58EABF-44CF-4C84-9DC5-49F69872AC4C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScript payload executes."}, {"lang": "es", "value": "Se detect\u00f3 un problema en el administrador de im\u00e1genes en Xoops versi\u00f3n 2.5.10. Cuando se desplaza la ruta de exploraci\u00f3n (breadcrumb) que muestra el nombre de la categor\u00eda sobre la edici\u00f3n de cualquier imagen, se ejecuta una carga \u00fatil de JavaScript."}], "id": "CVE-2019-16683", "lastModified": "2019-10-04T16:31:55.923", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-09-30T16:15:11.167", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.nirajkhatiwada.com.np/cve-2019-16683-stored-cross-site-scripting/"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/XOOPS/XoopsCore25/commits/master"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://xoops.org/modules/publisher/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}