CVE-2018-16249

In Symphony before 3.3.0, there is XSS in the Title under Post

published June 20, 2019

CVSS
—
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00524 · 43.6th percentile
Published
2019-06-20T13:54Z
EPSS history
Timeline
  • 20 JUN 13:54Z
    In Symphony before 3.3.0, there is XSS in the Title under Post
    cvelistv5