CVE-2015-1040 - CVE House
Back to Database
Status published Low CVE-2015-1040

Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in...

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lrealname field in the editProfile form to index.php/home/profile; the (2) data[title] or (3) data[description] field in the addQuickItem form to index.php; the (4) "note text" field in the saveNote form to index.php/areas; or the (5) titleBEObject or (6) tagsArea field in the updateForm form to index.php/documents/view.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-1040

Credits & Attribution

No credits recorded in the NVD database.

References

More from bedita

View All →
CVE-2019-15570
BEdita through 4.0.0-RC2 allows SQL injection during a save operation...
Critical 9.8
CVE-2015-9260
An issue was discovered in BEdita before 3.7.0. A cross-site...
Medium 5.4
CVE-2015-6809
Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow...
Medium 4.3

Affected Vendor

Affected Software

bedita
Vulnerable Versions:
3.4.0

Timeline

Official Publish: January 15th, 2015
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.