Description
Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter.
Affected products
- appserv_open_project / appserv2.5.10
- appserv_open_project / appserv1.0.0 – 1.0.0
- appserv_open_project / appserv1.2.0 – 1.2.0
- appserv_open_project / appserv1.3.0 – 1.3.0
- appserv_open_project / appserv1.4.0 – 1.4.0
- appserv_open_project / appserv1.5.0 – 1.5.0
- appserv_open_project / appserv1.6.0 – 1.6.0
- appserv_open_project / appserv1.7.0 – 1.7.0
- appserv_open_project / appserv1.8.0 – 1.8.0
- appserv_open_project / appserv1.9.0 – 1.9.0
- appserv_open_project / appserv2.0.0 – 2.0.0
- appserv_open_project / appserv2.1.0 – 2.1.0
- appserv_open_project / appserv2.2.0 – 2.2.0
- appserv_open_project / appserv2.3.0 – 2.3.0
- appserv_open_project / appserv2.4 – 2.4
- appserv_open_project / appserv2.4.1 – 2.4.1
- appserv_open_project / appserv2.4.2 – 2.4.2
- appserv_open_project / appserv2.4.3 – 2.4.3
- appserv_open_project / appserv2.4.4 – 2.4.4
- appserv_open_project / appserv2.4.4a – 2.4.4a
- appserv_open_project / appserv2.4.5 – 2.4.5
- appserv_open_project / appserv2.4.6 – 2.4.6
- appserv_open_project / appserv2.4.7 – 2.4.7
- appserv_open_project / appserv2.4.8 – 2.4.8
- appserv_open_project / appserv2.4.9 – 2.4.9
- appserv_open_project / appserv2.5 – 2.5
- appserv_open_project / appserv2.5.1 – 2.5.1
- appserv_open_project / appserv2.5.2 – 2.5.2
- appserv_open_project / appserv2.5.3 – 2.5.3
- appserv_open_project / appserv2.5.4 – 2.5.4
- appserv_open_project / appserv2.5.4a – 2.5.4a
- appserv_open_project / appserv2.5.5 – 2.5.5
- appserv_open_project / appserv2.5.6 – 2.5.6
- appserv_open_project / appserv2.5.7 – 2.5.7
- appserv_open_project / appserv2.5.8 – 2.5.8
- appserv_open_project / appserv2.5.9 – 2.5.9
Exploits & PoCs
- nucleiAppServ Open Project <=2.5.10 - Cross-Site Scriptingby unstabl3