CVE-2019-8410: XSS
Maccms 8.0 allows XSS via the inc/config/cache.php tkey parameter because template/paody/html/vodtype.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the tname parameter (not tkey).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-8410?
CVE-2019-8410 is a vulnerability that allows cross-site scripting (XSS) attacks in Maccms 8.0.
How does CVE-2019-8410 work?
CVE-2019-8410 works by mishandling the 'keywords' parameter in the 'template/paody/html/vod_type.html' file and only filtering the 't_name' parameter, allowing an attacker to inject malicious code through the 't_key' parameter in 'inc/config/cache.php'.
What is the severity of CVE-2019-8410?
CVE-2019-8410 has a severity keyword of 'medium' and a severity value of 6.1.
How can I fix CVE-2019-8410?
To fix CVE-2019-8410, update Maccms to a version that includes the necessary fixes for the vulnerability.
Where can I find more information about CVE-2019-8410?
You can find more information about CVE-2019-8410 at the following link: [Github - Maccms8 XSS Vulnerability](https://github.com/holychang/maccms8/blob/master/xss2)