Closed
Description
ziqiang.wang@dbappsecurity.com.cn
From this issue : #847 , the Cacti vendor has published the latest 1.1.13 to fix two XSS vuls.
But I just found a new xss vul in 1.1.13, plz donnt say its the same issue or ask why is there a new CVE number? Because it's a real vul in the latest 1.1.13.
Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
Metadata
Metadata
Assignees
Labels
No labels

