CVE-2021-44082

textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body

published March 29, 2022

CVSS
—
EPSS
3%
Percentile
87.4
In the wild
Unconfirmed
What it is

textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03037 · 87.4th percentile
Published
2022-03-29T22:50Z
EPSS history
Timeline
  • 29 MAR 22:50Z
    textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body
    cvelistv5