medium4.8Public exploit code
CVE-2019-14804
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- UNA 10.0.0 RC1 - 'polyglot.php' Persistent Cross-Site Scripting2019-08-12 · webapps · php
Impact
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Una | Una | Version 10.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/154018/UNA-10.0.0-RC1-Cross-Site-Scripting.html
- https://github.com/unaio/una/commits/master/studio
- https://pastebin.com/iMfs1BsM
- http://packetstormsecurity.com/files/154018/UNA-10.0.0-RC1-Cross-Site-Scripting.html
- https://github.com/unaio/una/commits/master/studio
- https://pastebin.com/iMfs1BsM