A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs" functionality of Webuzo.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-09-15T16:19:57

Updated: 2024-08-04T02:27:31.856Z

Reserved: 2021-08-30T00:00:00

Link: CVE-2021-40238

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-09-15T17:15:10.747

Modified: 2024-11-21T06:23:46.560

Link: CVE-2021-40238

cve-icon Redhat

No data.