CVE-2018-12944

EUVD-2018-4897
Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the name field.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
Affected Products (NVD)
VendorProductVersion
seeddmsseeddms
𝑥
< 5.1.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG
https://www.contextis.com/resources/advisories/cve-2018-12944
https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG
https://www.contextis.com/resources/advisories/cve-2018-12944