CVE-2018-15676

EUVD-2018-7547
An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_protection.php anti-XSS mechanism that looks for a number of dangerous fingerprints.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 37%
Affected Products (NVD)
VendorProductVersion
btiteamxbtit
𝑥
≤ 2.5.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://rastating.github.io/xbtit-multiple-vulnerabilities/
https://rastating.github.io/xbtit-multiple-vulnerabilities/