CVE-2018-19509 - wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with proper contextual encoding

Back Back to CVE browser

MEDIUM

wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with proper contextual encoding

Published Mar 17, 2019

6.1

MEDIUM

CVSS 3.0

EPSS 1.06%

Description

wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with proper contextual encoding. Because it is possible to insert arbitrary strings into the database, any JavaScript could be executed by the administrator, leading to XSS.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

http://packetstormsecurity.com/files/151017/Webgalamb-Information-Disclosure-XSS-CSRF-SQL-Injection.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Jan/15
x_refsource_MISCExploitMailing ListThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/151017/Webgalamb-Information-Disclosure-XSS-CSRF-SQL-Injection.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Jan/15		x_refsource_MISCExploitMailing ListThird Party Advisory