漏洞标题
完美调查 < 1.5.2 - 未授权的AJAX调用到存储的XSS / 调查设置更新
漏洞描述信息
完美调查 < 1.5.2 - 未授权的AJAX调用到存储的XSS / 调查设置更新
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
漏洞类别
N/A
漏洞标题
Perfect Survey < 1.5.2 - Unauthorised AJAX Call to Stored XSS / Survey Settings Update
漏洞描述信息
The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which will be executed in the context of a user viewing any survey
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
WordPress plugin 跨站请求伪造漏洞
漏洞描述信息
WordPress plugin是WordPress开源的一个应用插件。 WordPress plugin Perfect Survey 1.5.2之前版本存在跨站请求伪造漏洞，该漏洞源于没有适当的授权，也没有在save_global_setting AJAX 动作中进行CSRF检查，允许未经认证的用户编辑调查和修改设置。
CVSS信息
N/A
漏洞类别
跨站请求伪造