CVE-2015-2807

Nuclei

Navis DocumentCloud <0.1.1 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2015-2807 has a selected CVSS score of 4.3; EIP currently links 1 Nuclei template.

Description

Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMNavis DocumentCloud <0.1.1 - Cross-Site ScriptingCVSS 4.3

Navis DocumentCloud plugin before 0.1.1 for WordPress contains a reflected cross-site scripting vulnerability in js/window.php which allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade to a version higher than 0.1.1 that includes proper input sanitization to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscve2015cvewordpresswp-pluginxssdocumentcloudvuln
CVSS vector: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
CPE: cpe:2.3:a:documentcloud:navis_documentcloud:*:*:*:*:*:wordpress:*:*
Google: inurl:"/wp-content/plugins/navis-documentcloud"
https://advisories.dxw.com/advisories/publicly-exploitable-xss-in-wordpress-plugin-navis-documentcloud/ https://security.dxw.com/advisories/publicly-exploitable-xss-in-wordpress-plugin-navis-documentcloud/ https://wordpress.org/plugins/navis-documentcloud/changelog/ https://nvd.nist.gov/vuln/detail/CVE-2015-2807 https://wpvulndb.com/vulnerabilities/8164

Source: ProjectDiscovery

References

6