Executive brief
Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'.
Affected products
- PyPI lin-cms
Junglewise Threat Intelligence
CVE-2020-18699: PYSEC-2021-340 - Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Usernam
CVE-2020-18699 · Severity: low · CVSS 3.1 · Published 2021-08-16
Technologies: lin-cms (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-839 - Lin CMS vulnerable to Improper Authentication
- PYSEC-2021-339 - Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'lo
- PYSEC-2021-341 - Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the a