CWE Code: 79
Vulnerability Type: privilege_escalation
CVSS Score: 3.5
CWE Name:  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary: an xss issue was discovered in inhaltsprojekte in weblication cms core & grid v12.6.24. the vulnerability is located in the `wfilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. the injection point is located in the project `title` and the execution point occurs in the `inhaltsprojekte` output listing section. remote attackers with privileged user accounts are able to inject their own malicious script code with a persistent attack vector to compromise user session credentials or to manipulate the affected web-application module output context. the request method to inject is post.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/NONE
Published Date: 2018-06-29
Last Modified Date: 2018-08-20