CVE-2018-19922

https://notcve.org/view.php?id=CVE-2018-19922

Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTML into the Website Blocking page by inserting arbitrary HTML into the 'TodUrlAdd' URL parameter in a /urlfilter.cmd POST request. Cross-Site Scripting (XSS) persistente en la página Website Blocking en advancedsetup_websiteblocking.html del router Actiontec C1000A con firmware hasta la versión CAC004-31.30L.95 permite que un atacante remoto inyecte HTML arbitrario en la página Website Blocking insertando HTML arbitrario en el parámetro de la URL "TodUrlAdd" en una petición POST en /urlfilter.cmd. • https://github.com/logern5/c1000a_xss/blob/master/README.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •