cbcvebase.
CVE-2020-25786
published 2020-09-19

CVE-2020-25786: webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects…

medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: this is typically not exploitable because of URL encoding (except in Internet Explorer) and because a web page cannot specify that a client should make an additional HTTP request with an arbitrary Referer header

Affected

7 ranges
VendorProductVersion rangeFixed in
dlinkdir-645_firmware——
dlinkdir-803_firmware——
dlinkdir-815_firmware——
dlinkdir-816l_firmware——
dlinkdir-816l_firmware——
dlinkdir-860l_firmware——
dlinkdir-865l_firmware——