CVE-2018-5249

Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the ban_canLogin function in index.php).
Cross-site Scripting
Severity
MEDIUM
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Atk. Vector
NETWORK
Atk. Complexity
LOW
Priv. Required
NONE
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
VendorProductVersion
shaarli_projectshaarli
𝑥
< 0.8.5
shaarli_projectshaarli
0.9.0 ≤
𝑥
< 0.9.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
shaarli
bookworm
0.12.1+dfsg-8
fixed
sid
0.13.0+dfsg-3
fixed
trixie
0.13.0+dfsg-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
shaarli
disco
dne
cosmic
dne
bionic
dne
artful
dne
zesty
dne
xenial
not-affected
trusty
dne