Executive brief
Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'.
Affected products
- PyPI quokka
Junglewise Threat Intelligence
CVE-2020-18702: PYSEC-2021-143 - Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component
CVE-2020-18702 · Severity: low · CVSS 3.1 · Published 2021-08-16
Technologies: quokka (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2021-144 - XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.
- PYSEC-2021-145 - XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.