6.1med
CVE-2018-12652
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
6.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 59%
Public exploits
0
none known
Summary
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the LeaveEmployeeSearch.aspx prntFrmName or prntDDLCntrlName parameter.
Exploit prediction (EPSS)
0.86% probability of exploitation in the next 30 days, higher than 59% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- securethy.com /2019/02/CVE-2018-12652-reflected-XSS.html
- knowcybersec.com /2019/02/CVE-2018-12652-reflected-XSS.html · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-12652
- NVD: CVE-2018-12652
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.