holychang/maccms8

Releases0

Stars1

xss

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2018-19465 ↗	Jun 7, 2019Friday, 7 June 2019, 17:29	—	4.3 MEDIUM
Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_config.html, related to template/paody/html/vod_index.html.
CVE-2019-8410 ↗	Feb 27, 2019Wednesday, 27 February 2019, 17:29	—	4.3 MEDIUM
Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the t_name parameter (not t_key).