CVE-2022-1087 - htmly Edit Profile Module cross site scripting

Back Back to CVE browser

MEDIUM

htmly Edit Profile Module cross site scripting

Published Mar 29, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.94%

Description

A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profile Module. The manipulation of the field Title with script tags leads to persistent cross site scripting. The attack may be initiated remotely and requires an authentication. A simple POC has been disclosed to the public and may be used.

Affected products

Vendor n/a Product Htmly Default
n/a
- Version
  5.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Htmly

n/a

Version	Status	Constraints
5.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-24431
Advisory
https://github.com/liaojia-99/project/blob/main/htmly/1.md
x_refsource_MISCExploitThird Party Advisory
https://github.com/liaojia-99/project/tree/main/htmly
x_refsource_MISCExploitThird Party Advisory
https://vuldb.com/?id.195203
x_refsource_MISCThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-24431		Advisory
https://github.com/liaojia-99/project/blob/main/htmly/1.md		x_refsource_MISCExploitThird Party Advisory
https://github.com/liaojia-99/project/tree/main/htmly		x_refsource_MISCExploitThird Party Advisory
https://vuldb.com/?id.195203		x_refsource_MISCThird Party AdvisoryVDB Entry