Syguestbook A5 Project Syguestbook A5
3 CVEs affecting Syguestbook A5 Project Syguestbook A5. Latest disclosed: 2019-07-18. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13949 | High | 8.8 | 2019-07-18 | SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change. |
CVE-2019-13950 | Medium | 5.4 | 2019-07-18 | index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment. |
CVE-2019-13948 | Medium | 5.4 | 2019-07-18 | SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by… |