Daloradius · Radius Manager · CVE-2010-4275
**Name of the Vulnerable Software and Affected Versions**
Radius Manager version 3.8.0
**Description**
The issue allows remote authenticated administrators to inject arbitrary web script or HTML. This can be achieved via the `name` or `descr` parameter in an "update usergroup" or "store nas" action to "admin.php".
**Recommendations**
For Radius Manager version 3.8.0, consider restricting access to the "admin.php" endpoint until a patch is available, and avoid using the `name` and `descr` parameters in the "update usergroup" and "store nas" actions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.