Medium severity5.4NVD Advisory· Published Aug 26, 2021· Updated Jun 17, 2026
CVE-2020-18469
CVE-2020-18469
Description
Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in Rukovoditel 2.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to /rukovoditel_2.4.1/index.php?module=configuration/save&redirect_to=configuration/application.
Affected products
2- Rukovoditel/Rukovoditeldescription
- Range: =2.4.1
Patches
Vulnerability mechanics
References
2- github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/3nvdExploitIssue TrackingThird Party Advisory
- github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/5nvdExploitIssue TrackingThird Party Advisory
News mentions
0No linked articles in our index yet.