Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmb
Vulnerability Description
LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
LedgerSMB 跨站脚本漏洞
Vulnerability Description
LedgerSMB是一个免费的基于网络的复式记账系统，具有报价、订购、发票、项目、考勤卡、库存管理、运输等功能。 LedgerSMB 存在安全漏洞，该漏洞源于应用没有对发送到浏览器的错误消息进行充分的 HTML 编码。通过向经过身份验证的用户发送特制的 URL，可以利用此漏洞进行远程代码执行和信息泄露。
CVSS Information
N/A
Vulnerability Type
N/A