CVE-2020-23376

Published: 2021-05-10T23:15Z

Last Modified: 2024-11-21T05:13Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt