CVE-2018-16405

MEDIUM

Mayan EDMS < 3.0.2 - Cross-Site Scripting via Appearance App

Title source: llm

An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.

Core 3

Core References

Exploit, Patch, Third Party Advisory x_refsource_misc

Patch, Third Party Advisory x_refsource_misc

Third Party Advisory x_refsource_misc

CVSS v3 6.1

EPSS 0.0032

EPSS Percentile 54.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79

Status published

Products (3)

mayan-edms/mayan_edms < 3.0.2

pypi/mayan-edms 0 - 3.0.2PyPI

pypi/mayan-edms-ng 0 - 3.0.2PyPI

Published Sep 03, 2018

Tracked Since Feb 18, 2026