CVE-2015-5720

MediumCVSS 6.1/10Last modified Jun 23, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) add.ctp, (2) edit.ctp, and (3) ajaxification.js.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/92738
https://github.com/MISP/MISP/commit/812ac878c3645c02e2a599287117418424cbd4cfIssue Tracking, Patch
https://www.circl.lu/advisory/CVE-2015-5720/Third Party Advisory
http://www.securityfocus.com/bid/92738
https://github.com/MISP/MISP/commit/812ac878c3645c02e2a599287117418424cbd4cfIssue Tracking, Patch
https://www.circl.lu/advisory/CVE-2015-5720/Third Party Advisory

Timeline

Published: Sep 3, 2016
Last modified: Jun 23, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-57219.8Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serial CVE-2015-57227.8buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertio CVE-2015-57237.8Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 o CVE-2015-57259.8SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute a CVE-2015-57267.5The BER decoder in Botan 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (application c CVE-2015-57277.5The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consum CVE-2015-57299.8The Soft Access Point (AP) feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK CVE-2015-57305.0The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time c CVE-2015-57316.8Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authent CVE-2015-57324.3Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPres CVE-2015-57334.3Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4 CVE-2015-57344.3Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allow