concrete5 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2014-5108 - Vulnerability Database

concrete5

concrete5 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2014-5108

Medium

Reference: CVE-2014-5108

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2014-5108

Title: concrete5 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

Cross-site scripting (XSS) vulnerability in single_pagesdownload_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.