Description (CNA)
projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load the affected page, enabling persistent script injection.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| projectSend / projectSend | affected r1605 |
CWE
CWE-79
References
- https://www.exploit-db.com/exploits/51518
- https://www.projectsend.org/
- https://www.vulncheck.com/advisories/projectsend-stored-cross-site-scripting-via-custom-assets-page
ADP enrichment
No English description supplied.