medium5.4Public exploit code
CVE-2019-17225
Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Subrion 4.2.1 - 'Email' Persistant Cross-Site Scripting2019-10-07 · webapps · php
Impact
Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Intelliants | Subrion | Version 4.2.1 |