Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmb
Vulnerability Description
LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
LedgerSMB 跨站脚本漏洞
Vulnerability Description
LedgerSMB是一个免费的基于网络的复式记账系统，具有报价、订购、发票、项目、考勤卡、库存管理、运输等功能。 LedgerSMB 存在安全漏洞，该漏洞源于应用不会检查合并到浏览器 DOM 中的 HTML 片段的来源。通过向经过身份验证的用户发送特制的 URL，可以利用此漏洞进行远程代码执行和信息泄露。
CVSS Information
N/A
Vulnerability Type
N/A