CVE-2019-8349

2019-05-0814:29:00

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.9%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) destination parameter to delete feature; the (2) destination parameter to edit feature; (3) content parameter in the profile feature.

CPENameOperatorVersion
htmlyeq2.6.1
htmlyeq2.6.4
htmlyeq2.7.3
htmlyeq2.5.6
htmlyeq2.6.5
htmlyeq2.0
htmlyeq2.6.8
htmlyeq1.1
htmlyeq2.4.1
htmlyeq2.5.8

Name	Operator	Version
htmly	eq	2.6.1
htmly	eq	2.6.4
htmly	eq	2.7.3
htmly	eq	2.5.6
htmly	eq	2.6.5
htmly	eq	2.0
htmly	eq	2.6.8
htmly	eq	1.1
htmly	eq	2.4.1
htmly	eq	2.5.8

Rows per page:

1-10 of 381

References

packetstormsecurity.com/files/151733/HTMLy-2.7.4-Cross-Site-Scripting.html

seclists.org/fulldisclosure/2019/Feb/40

www.netsparker.com/web-applications-advisories/