medium4.8
CVE-2018-7547
lyadmin 1.x has XSS via the config[WEB_SITE_TITLE] parameter to the /admin.php?s=/admin/config/groupsave.html URI.
Impact
lyadmin 1.x has XSS via the config[WEB_SITE_TITLE] parameter to the /admin.php?s=/admin/config/groupsave.html URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lingyun | Lyadmin | from 1.0.0 through 1.2.0 |