CVE-2018-16622

Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/userAddContent.

Score

CVSS 3.0 5.4 Medium

Status

Modified - cve@mitre.org

Published

2018-09-06

Last modified

2024-09-17

Weaknesses

CWE-79

Affected products

• Doracms (Html-js)

References

• https://github.com/doramart/DoraCMS/issues/136