CVE-2018-14977: XSS

Published Aug 6, 2018

Updated

An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different vulnerability than CVE-2018-8070.

Affected Software

1 affected component

Q-cms Qcms=3.0.1

Event History

Aug 6, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

Which component and input are associated with the vulnerability?

QCMS 3.0.1 is identified as affected. The issue is in upload/System/Controller/guest.php and is demonstrated through the name parameter.

What access and conditions does an attacker need to exploit this issue?

An attacker does not need authentication, but exploitation requires a user to interact with attacker-controlled content or a request. The CVSS vector indicates network reachability, low attack complexity, and required user interaction.

What is the likely impact of successful exploitation?

Successful exploitation can expose or alter information in the context affected by the XSS issue. The CVSS vector assigns low confidentiality and integrity impact and no availability impact.

CVE-2018-14977: XSS

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

Which component and input are associated with the vulnerability?

What access and conditions does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which component and input are associated with the vulnerability?

What access and conditions does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?