Description (CNA)
CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads like ')-alert(1)// and execute arbitrary JavaScript when victims interact with delete buttons.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Cmsimple / CMSimple | affected <=5.4 |
CWE
CWE-79
References
- https://www.exploit-db.com/exploits/50612
- https://www.cmsimple.org/en/
- https://www.vulncheck.com/advisories/cmsimple-cross-site-scripting-via-html-unicode-encoding
ADP enrichment
No English description supplied.
No references supplied.