CVE-2019-12361

EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template

published May 27, 2019

CVSS
—
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.5th percentile
Published
2019-05-27T22:49Z
EPSS history
Timeline
  • 27 MAY 22:49Z
    EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template
    cvelistv5