medium5.4
CVE-2020-14146
KumbiaPHP Cross-site Scripting
Impact
KumbiaPHP through 1.1.1, in Development mode, allows XSS via the `public/pages/kumbia/PATH_INFO`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | kumbiaphp/kumbiapp | <= 1.1.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kumbiaphp | Kumbiaphp | through 1.1.1 |