diff --git a/cves/2015/CVE-2015-9312.yaml b/cves/2015/CVE-2015-9312.yaml index cb5178aaad..4e29261dfc 100644 --- a/cves/2015/CVE-2015-9312.yaml +++ b/cves/2015/CVE-2015-9312.yaml @@ -5,7 +5,7 @@ info: author: r3Y3r53 severity: medium description: | - The NewStatPress plugin utilizes on lines 28 and 31 of the file ‘includes/nsp_search.php’ several variables from the $_GET scope, without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to trigger a Reflected XSS attack. + The NewStatPress plugin hafl utilizes on lines 28 and 31 of the file ‘includes/nsp_search.php’ several variables from the $_GET scope, without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to trigger a Reflected XSS attack. reference: - https://wpscan.com/vulnerability/46bf6c69-b612-4aee-965d-91f53f642054 - https://nvd.nist.gov/vuln/detail/CVE-2015-9312 @@ -43,4 +43,4 @@ requests: - 'contains(body_2, "newstatpress")' condition: and -# Enhanced by md on 2023/03/14 +# Enhanced by md on 2023/03/15