CVE-2019-14228

Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at…

published July 26, 2019

CVSS
—
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/includes/adminprocess.php. If there is an error when registering the user, the unsanitized username will reflect via the error page. Due to the lack of CSRF protection on the admin/includes/adminprocess.php endpoint, an attacker is able to chain the XSS with CSRF in order to cause remote exploitation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Published
2019-07-26T12:35Z
EPSS history
Timeline
  • 26 JUL 12:35Z
    Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at…
    cvelistv5