CVE-2018-19350

In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.

Score

CVSS 3.0 5.4 Medium

Status

Modified - cve@mitre.org

Published

2018-11-17

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Seacms (Seacms)

References

• https://github.com/Xmansec/seacms_vul/tree/master/XSS