fragrant10/fragrant10.github.io

Releases0

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2019-13948 ↗	Jul 18, 2019Thursday, 18 July 2019, 16:15	—	3.5 LOW
SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by a crafted use of the onerror attribute of an IMG element.
CVE-2019-13949 ↗	Jul 18, 2019Thursday, 18 July 2019, 16:15	—	6.8 MEDIUM
SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change.
CVE-2019-13950 ↗	Jul 18, 2019Thursday, 18 July 2019, 16:15	—	3.5 LOW
index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment.