CVE-2014-8674
MEDIUM 5.4EPSS 2.6%
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code.
- CVSS v3.1
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0
- 3.5 LOW
AV:N/AC:M/Au:S/C:N/I:P/A:N - EPSS
- 2.65% chance of exploitation in the next 30 days, 85th percentile
- Published
- 2020-01-06
- Updated
- 2024-08-06
Proof-of-concept exploits (2)
- http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Inj…
- http://seclists.org/fulldisclosure/2015/Jul/44