CVE-2020-25071

Katalog CVE

CVSS 5.4 · Medium EPSS 0,68%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada niftypm nifty. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visit. Note: It has been argued that this is not reproducible. "The original issue was that the task would be created and an alert would be shown on the screen. Now the task would be created, but the alert won't be executed as those attributes are now stripped.

Rincian

Terbit di NVD

15 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 50,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://niftypm.com/security advisory vendor
• https://medium.com/%40muffydium/a-tale-of-reflected-xss-to-stored-which-ultimately-resulted-into-a-cve-82981f8...