CVE-2018-14976: XSS
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS.
Affected Software
Event History
Frequently Asked Questions
What access and conditions does an attacker need to exploit this issue?
Exploitation requires network access, high privileges, and user interaction. The CVSS vector indicates that a victim must interact with attacker-supplied content for the XSS to have an effect.
Which part of the application should be prioritized for review?
The affected component is the backend category controller at upload/System/Controller/backend/category.php in QCMS 3.0.1. This points to exposure in the administrative/backend category-management functionality rather than a public-facing component identified in the available data.
What is the expected security impact of successful exploitation?
The vulnerability can affect confidentiality and integrity at a low level, while no availability impact is indicated. Because the scope is changed in the CVSS vector, successful exploitation may affect resources outside the vulnerable component's security authority.