medium6.1Public exploit code
CVE-2018-12090
There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows a remote attacker to introduce arbitrary JavaScript via manipulati…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- LAMS < 3.1 - Cross-Site Scripting2018-08-06 · webapps · java
Impact
There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows a remote attacker to introduce arbitrary JavaScript via manipulation of an unsanitized GET parameter during a forgotPasswordChange.jsp?key= password change.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lamsfoundation | Lams | before 3.1 |