| Assigner | INCIBE |
| Reserved | 2024-05-16 |
| Published | 2024-05-16 |
| Updated | 2024-06-04 |
Description
Vulnerability in SiAdmin 1.1 that allows XSS via the /show.php query parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and thereby steal their cookie session credentials.
| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
Problem types
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Product status
1.1
Credits
Rafael Pedrero
References
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-siadmin
