CVE-2015-7391
Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selected_end_date or (2) selected_start_date parameter to lib/results/tcCreatedPerUserOnTestProject.php; the (3) containerType parameter to lib/testcases/containerEdit.php; the (4) filter_tc_id or (5) filter_testcase_name parameter to lib/testcases/listTestCases.php; the (6) useRecursion parameter to lib/testcases/tcImport.php; the (7) targetTestCase or (8) created_by parameter to lib/testcases/tcSearch.php; or the (9) HTTP Referer header to third_party/user_contribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php.
- Score
- CVSS 3.0 6.1 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2017-09-26
- Last modified
- 2024-08-06
- Weaknesses
- CWE-79
Affected products
References
- http://www.securityfocus.com/archive/1/536622/100/0/threaded
