CVE-2020-14413

NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php

published June 29, 2020

CVSS
—
EPSS
3%
Percentile
89.0
In the wild
Unconfirmed
What it is

NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta= value.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03472 · 89.0th percentile
Published
2020-06-29T16:37Z
EPSS history
Timeline
  • 29 JUN 16:37Z
    NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php
    cvelistv5