CVE-2015-7391

NONE EPSS 50.7%

Published Sep 26, 20178y ago · Modified Jun 17, 20262w ago

Published Sep 26, 2017 8y ago

Last Modified Jun 17, 2026 2w ago

Description

Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selected_end_date or (2) selected_start_date parameter to lib/results/tcCreatedPerUserOnTestProject.php; the (3) containerType parameter to lib/testcases/containerEdit.php; the (4) filter_tc_id or (5) filter_testcase_name parameter to lib/testcases/listTestCases.php; the (6) useRecursion parameter to lib/testcases/tcImport.php; the (7) targetTestCase or (8) created_by parameter to lib/testcases/tcSearch.php; or the (9) HTTP Referer header to third_party/user_contribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php.

Threat Intelligence

EPSS Exploit Probability

50.7% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
testlink	testlink	*	≤1.9.13

References 1

securityfocus.com http://www.securityfocus.com/archive/1/536622/100/0/threaded

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.