CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-27920
https://notcve.org/view.php?id=CVE-2022-27920
libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0. libkiwix versiones 10.0.0 y 10.0.1, permite una vulnerabilidad de tipo XSS en la funcionalidad del servidor web integrado por medio del parámetro URL de sugerencias de búsqueda. Esto ha sido corregido en versión 10.1.0 • https://github.com/kiwix/libkiwix/issues/728 https://github.com/kiwix/libkiwix/pull/721 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KD4KX5N2PGMIOQR2IZWEUTZCCTPWU3EJ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2015-1032
https://notcve.org/view.php?id=CVE-2015-1032
Cross-site scripting (XSS) vulnerability in Kiwix before 0.9.1, when using kiwix-serve, allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to /search. Vulnerabilidad XSS en Kiwix anterior a 0.9.1, al usar kiwix-serve, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del patrón del parámetro /search. • http://packetstormsecurity.com/files/130007/Kiwix-Cross-Site-Scripting.html http://sourceforge.net/p/kiwix/bugs/763 http://sourceforge.net/p/kiwix/kiwix/ci/d1af5f0375c6db24d4071acf4806735725fd206e http://www.securityfocus.com/archive/1/534502/100/0/threaded • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •