Description
Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert XSS payloads in project task comments to execute arbitrary JavaScript in victim browsers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rukovoditel | Rukovoditel | 3.4.1 | — |
References
- ExploitDB-51548 exploit
- Rukovoditel Product Webpage product
- VulnCheck Advisory: Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Comments third-party-advisory