Cross-site scripting (XSS) vulnerability in DaDaBIK before 4.3 beta2, when the insert or edit feature is enabled, allows remote authenticated users to inject arbitrary web script or HTML via the select_single parameter.
CVSS 2.0
Severity: LOW
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dadabik | dadabik | 2.0.1 |
| dadabik | dadabik | 4.3 |
| dadabik | dadabik | 1.7 |
| dadabik | dadabik | 1.0 |
| dadabik | dadabik | 1.1 |
| dadabik | dadabik | 3.0 |
| dadabik | dadabik | 4.1 |
| dadabik | dadabik | 1.9.1 |
| dadabik | dadabik | 2.2 |
| dadabik | dadabik | 3.2 |
| dadabik | dadabik | 1.5b |
| dadabik | dadabik | 4.0 |
| dadabik | dadabik | 1.6 |
| dadabik | dadabik | 3.1 |
| dadabik | dadabik | 1.0.5 |
| dadabik | dadabik | 1.9 |
| dadabik | dadabik | * |
| dadabik | dadabik | 1.0.3 |
| dadabik | dadabik | 2.0 |
| dadabik | dadabik | 1.0.2 |
| dadabik | dadabik | 2.1 |
| dadabik | dadabik | 1.0.1 |
| dadabik | dadabik | 2.1b |
| dadabik | dadabik | 2.2.1 |
| dadabik | dadabik | 1.5 |
| dadabik | dadabik | 4.2 |
| dadabik | dadabik | 1.0.4 |
| dadabik | dadabik | 1.8 |
DaDaBIK 4.3 beta3, when running in a case-sensitive environment, does not include the htmLawed library, which allows remote attackers to bypass the protection mechanism for CVE-2010-4355 and conduct cross-site scripting (XSS) attacks via the (1) html content and (2) rich_editor fields. NOTE: some of these details are obtained from third party information.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dadabik | dadabik | 4.3 |