medium6.1Public exploit code
CVE-2019-11398
Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parame…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting2019-06-10 · webapps · php
- UliCMS 2019.2 / 2019.1 - Multiple Cross-Site Scripting2019-04-22 · webapps · php
Impact
Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ulicms | Ulicms | Versions 2019.1, 2019.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/153219/UliCMS-2019.1-Cross-Site-Scripting.html
- https://en.ulicms.de/
- https://www.exploit-db.com/exploits/46741/
- http://packetstormsecurity.com/files/153219/UliCMS-2019.1-Cross-Site-Scripting.html
- https://en.ulicms.de/
- https://www.exploit-db.com/exploits/46741/