CVE-2017-10711

Name of the Vulnerable Software and Affected Versions SimpleRisk version 20170614-001

Description A CSRF attack on the 'reset.php' endpoint, specifically the Send Password Reset Email form, can insert XSS sequences via the user parameter.

Recommendations For version 20170614-001, consider disabling the Send Password Reset Email form temporarily until a patch is available to prevent CSRF attacks that could lead to XSS sequence insertion. Restrict access to the 'reset.php' endpoint to minimize the risk of exploitation. Avoid using the user parameter in the affected form until the issue is resolved.