3 results (0.004 seconds)

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-18200

https://notcve.org/view.php?id=CVE-2018-18200

There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4. Hay una inyección SQL en Benutzerverwaltung en REDAXO en versiones anteriores a la 5.6.4. • https://github.com/redaxo/redaxo/releases/tag/5.6.4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-18199

https://notcve.org/view.php?id=CVE-2018-18199

Mediamanager in REDAXO before 5.6.4 has XSS. Mediamanager en REDAXO en versiones anteriores a la 5.6.4 tiene Cross-Site Scripting (XSS). • https://github.com/redaxo/redaxo/releases/tag/5.6.4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2018-18198

https://notcve.org/view.php?id=CVE-2018-18198

The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=[XSS] request. La variable $opener_input_field en addons/mediapool/pages/index.php en REDAXO 5.6.3 no está filtrada de forma efectiva y se envía directamente a la página. El atacante puede insertar cargas útiles XSS mediante una petición index.php? • https://github.com/redaxo/redaxo/releases/tag/5.6.4 https://github.com/redaxo/redaxo4/issues/422 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •