CVE-2014-125109

Name
CVE-2014-125109
Description
A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.27. It has been declared as problematic. This vulnerability affects the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.28 is able to address this issue. The name of the patch is d2ede580474665af56ff262a05783fbabe4529b8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248956.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cna@vuldb.com https://github.com/wp-plugins/portfolio/commit/d2ede580474665af56ff262a05783fbabe4529b8
cna@vuldb.com https://vuldb.com/?ctiid.248956
cna@vuldb.com https://vuldb.com/?id.248956

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:bestwebsoft:portfolio:*:*:*:*:*:wordpress:*:* portfolio >= None < 2.28

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
portfolio 3.19-community 1.0.0-r0 Clayton Craft <clayton@craftyguy.net> possibly vulnerable
portfolio edge-community 1.0.1-r1 Clayton Craft <clayton@craftyguy.net> possibly vulnerable
portfolio 3.20-community 1.0.1-r1 Clayton Craft <clayton@craftyguy.net> possibly vulnerable