Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Link | Tags |
---|---|
https://github.com/security-breachlock/CVE-2018-16631/blob/master/Subrion_cms.pdf | third party advisory exploit |