Cross-Site Scripting (XSS)

2022-11-1003:28:31

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

intelliants/subrion

cross-site scripting

admin-controllable input

_assignvalues function

fields.php

tooltip text field

EPSS

0.001

Percentile

40.2%

JSON

intelliants/subrion is vulnerable to cross-site scripting. The vulnerability exists due to lack of sanitization in admin-controllable input caused by the _assignValues function of fields.php, which allows an attacker to inject and execute malicious HTML and script code into the web site via the tooltip text field.