Stored XSS in Veribilim Software's Veribase Order Management
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, CWE - 83 Improper Neutralization of Script in Attributes in a Web Page vulnerability in Veribilim Software Veribase Order allows Stored XSS, Cross-Site Scripting (XSS), Exploit Script-Based APIs, XSS Through HTTP Headers.This issue affects Veribase Order: before v4.010.3.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-79 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
| CWE | CWE-116 | CWE-116 Improper Encoding or Escaping of Output |
| N/A | N/A | CWE - 83 Improper Neutralization of Script in Attributes in a Web Page |
Type: CWE
Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Type: CWE
Description: CWE-116 Improper Encoding or Escaping of Output
Type: N/A
CWE ID: N/A
Description: CWE - 83 Improper Neutralization of Script in Attributes in a Web Page
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 4.0 | 9.4 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Version: 4.0
Base score: 9.4
Base severity: CRITICAL
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Impacts
| CAPEC ID | Description |
|---|
| CAPEC-592 | CAPEC-592 Stored XSS |
| CAPEC-63 | CAPEC-63 Cross-Site Scripting (XSS) |
| CAPEC-160 | CAPEC-160 Exploit Script-Based APIs |
| CAPEC-86 | CAPEC-86 XSS Through HTTP Headers |
Description: CAPEC-592 Stored XSS
Description: CAPEC-63 Cross-Site Scripting (XSS)
Description: CAPEC-160 Exploit Script-Based APIs
Description: CAPEC-86 XSS Through HTTP Headers