CVE-2015-6969

Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.94% chance of exploitation in the next 30 days, 79th percentile

Published

2015-09-16

Updated

2024-09-16

Proof-of-concept exploits (1)

• http://seclists.org/fulldisclosure/2015/Sep/9

References

• CVE Record
• NVD entry

Related

• CVE-2015-6968
• CVE-2015-6970
• CVE-2015-6967
• CVE-2015-6972
• CVE-2015-6965
• CVE-2015-6973