CVE-2015-2210

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Sep 6, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-22137.5SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackeCVE-2015-22145.0NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirect_url parameter to netshop/post.php.CVE-2015-22155.8Open redirect vulnerability in the Services single sign-on server helper (services_sso_server_helper) module for Drupal allows remote attackCVE-2015-22167.5SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL coCVE-2015-22174.3Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrarCVE-2015-22184.3Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio PlaCVE-2015-22197.2Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gaCVE-2015-22204.3Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to injecCVE-2015-22215.0ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.CVE-2015-22225.0ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file.CVE-2015-22234.3Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly CyveCVE-2015-22306.1Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.