CVE-2020-35984

MEDIUM NUCLEI

Rukovoditel 2.7.2 - Authenticated Stored Cross-Site Scripting via Users Alerts Title Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-35984 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter.

Nuclei Templates (1)

Rukovoditel <= 2.7.2 - Cross Site Scripting
MEDIUMVERIFIEDby r3Y3r53
Shodan: http.favicon.hash:-1499940355
FOFA: icon_hash=-1499940355

References (1)

Core 1
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/r0ck3t1973/rukovoditel/issues/4

Scores

CVSS v3 5.4
EPSS 0.0133
EPSS Percentile 67.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
rukovoditel/rukovoditel 2.7.2
Published Jul 09, 2021
Tracked Since Feb 18, 2026