NVD

Id
26342  
Name
CVE-2015-5076  
Description
Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) version parameter in protected/views/admin/formEditor.php; the (2) importId parameter in protected/views/admin/rollbackImport.php; the (3) bc, (4) fg, (5) bgc, or (6) font parameter in protected/views/site/listener.php; the (7) Services[*] parameter in protected/components/views/webForm.php; the (8) file parameter in protected/components/TranslationManager.php; the (9) x2_key parameter in protected/tests/webscripts/x2WebTrackingTestPages/customWebLeadCaptureScriptTest.php; the (10) id parameter in protected/modules/contacts/controllers/ContactsController.php; or the (11) lastEventId parameter to index.php/profile/getEvents.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-09-29  
Modified Date
2016-12-07  
Seq
2015-5076  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
139301 26342 CVE-2015-5076 http://packetstormsecurity.com/files/133716/X2Engine-4.2-Cross-Site-Scripting.html  View
139302 26342 CVE-2015-5076 20150925 CVE-2015-5076 - Vulnerability title: Reflective XSS In X2Engine Inc. X2Engine  View
139303 26342 CVE-2015-5076 20150925 CVE-2015-5076 - Vulnerability title: Reflective XSS In X2Engine Inc. X2Engine  View
139304 26342 CVE-2015-5076 https://github.com/X2Engine/X2CRM/commit/10b72bfe7a1b9694f19a0adef72d85a754d4d3f8  View
139305 26342 CVE-2015-5076 https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-5076/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
9690 JVNDB-2015-005010 X2Engine X2CRM におけるクロスサイトスクリプティングの脆弱性 X2Engine X2CRM には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2015-5076 82301 CVE-2015-5076 26342 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-005010.html 2015-07-13 2015-10-01 View