CVE-2018-14513

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0

Description A persistent XSS issue was found, allowing remote attackers to inject arbitrary web script or HTML via the form[content] parameter to the "index.php?m=feedback&f=index&v=contact" API endpoint.

Recommendations For WUZHI CMS version 4.1.0, as a temporary workaround, consider restricting access to the form[content] parameter in the "index.php?m=feedback&f=index&v=contact" API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.