Description
Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator-s browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator-s privileges.
CVSS 6.1EPSS 0.308%Risque 0.63
Voir la source- Publication
- 2026-07-13 18:16:30
- Versions concernées
- <3.2.0
- Type
- Logiciel critique
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N