CVE-2015-4699

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2015/Dec/48Mailing List, Third Party Advisory, VDB Entry
http://www.quantumleap.it/cloud4wi-splash-portal-reflected-xss-vulnerability-cve-2015-4699/Exploit, Third Party Advisory
https://cloud4wi.zendesk.com/hc/en-us/articles/204956829-Cloud4Wi-5-9-7-Release-NoteRelease Notes, Third Party Advisory
http://seclists.org/fulldisclosure/2015/Dec/48Mailing List, Third Party Advisory, VDB Entry
http://www.quantumleap.it/cloud4wi-splash-portal-reflected-xss-vulnerability-cve-2015-4699/Exploit, Third Party Advisory
https://cloud4wi.zendesk.com/hc/en-us/articles/204956829-Cloud4Wi-5-9-7-Release-NoteRelease Notes, Third Party Advisory

Timeline

Published: Aug 24, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-47004.9The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of ser CVE-2015-47035.3Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to CVE-2015-47047.5Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files v CVE-2015-47066.1Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vector CVE-2015-47076.1Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors in CVE-2015-47136.5SQL injection vulnerability in ApPHP Hotel Site 3.x.x allows remote editors to execute arbitrary SQL commands via the pid parameter to index CVE-2015-47144.3Cross-site scripting (XSS) vulnerability in the DreamBox DM500-S allows remote attackers to inject arbitrary web script or HTML via the mode CVE-2015-47154.9The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an CVE-2015-471610.0Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, CVE-2015-47177.8The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_G CVE-2015-47189.0The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated user CVE-2015-47199.8The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.