CVE-2019-25093

LOW

recent_threads_on_index < 2019-02-06 - Cross-Site Scripting via recentthread_forumskip Parameter

Title source: llm

Description

A vulnerability, which was classified as problematic, was found in dragonexpert Recent Threads on Index. Affected is the function recentthread_list_threads of the file inc/plugins/recentthreads/hooks.php of the component Setting Handler. The manipulation of the argument recentthread_forumskip leads to cross site scripting. It is possible to launch the attack remotely. The patch is identified as 051465d807a8fcc6a8b0f4bcbb19299672399f48. It is recommended to apply a patch to fix this issue. VDB-217182 is the identifier assigned to this vulnerability.

References (3)

Core 3

Core References

Third Party Advisory vdb-entry technical-description

https://vuldb.com/?id.217182

Third Party Advisory signature permissions-required

https://vuldb.com/?ctiid.217182

Patch patch

https://github.com/dragonexpert/recentthreads/commit/051465d807a8fcc6a8b0f4bcbb19299672399f48

View Patch ZIP pw:eip

Scores

CVSS v3 2.4

EPSS 0.0051

EPSS Percentile 39.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

recent_threads_on_index_project/recent_threads_on_index < 2019-02-06

Published Jan 02, 2023

Tracked Since Feb 18, 2026