4.3

CVE-2013-3082

Exploit
Cross-site scripting (XSS) vulnerability in plugins/jojo_core/forgot_password.php in Jojo before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the search parameter to forgot-password/.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jojocms ≫ Jojo-cms Version <= 1.2.1
Jojocms ≫ Jojo-cms Version1.1
Jojocms ≫ Jojo-cms Version1.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.23% 0.866
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.htbridge.com/advisory/HTB23153
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/84286
https://github.com/JojoCMS/Jojo-CMS/commit/9c000f961635e35e9984a8c16ca69c2cbf2d2236
Patch
Exploit