CVE-2009-10004

Katalog CVE

CVSS 6.1 · Medium EPSS 0,53%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada sandbox theme project sandbox theme. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in Turante Sandbox Theme up to 1.5.2. It has been classified as problematic. This affects the function sandbox_body_class of the file functions.php. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.6.1 is able to address this issue. The identifier of the patch is 8045b1e10970342f558b2c5f360e0bd135af2b10. It is recommended to upgrade the affected component. The identifier VDB-225357 was assigned to this vulnerability.

Rincian

Terbit di NVD

10 April 2023

Terakhir diubah

1 Oktober 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Turante/sandbox-theme/commit/8045b1e10970342f558b2c5f360e0bd135af2b10 patch
• https://vuldb.com/?ctiid.225357 permissions required · advisory pihak ketiga
• https://vuldb.com/?id.225357 permissions required · advisory pihak ketiga
• https://github.com/Turante/sandbox-theme/releases/tag/1.6.1 release notes