CVE-2021-40973 - Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter

Back Back to CVE browser

MEDIUM

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter

Published Oct 1, 2021

6.1

MEDIUM

CVSS 3.1

EPSS 2.25%

Description

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-28127
Advisory
https://github.com/spotweb/spotweb
x_refsource_MISCThird Party Advisory
https://github.com/spotweb/spotweb/issues/711
x_refsource_MISCExploitIssue TrackingThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-28127		Advisory
https://github.com/spotweb/spotweb		x_refsource_MISCThird Party Advisory
https://github.com/spotweb/spotweb/issues/711		x_refsource_MISCExploitIssue TrackingThird Party Advisory