CVE-2021-28088

2021-03-1117:15:13

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.5%

JSON

Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML parameters through the “Display Name” field.

CPENameOperatorVersion
impresscmseq1.4.0-alpha.2
impresscmseq1.4.0-rc
impresscmseqimpresscms_1.3.3
impresscmseq1.3.11-rc2
impresscmseq1.3.10-beta
impresscmseq1.3.11-beta
impresscmseq1.3.8
impresscmseq1.3.11
impresscmseq1.3.9
impresscmseq1.3.9_rc

Name	Operator	Version
impresscms	eq	1.4.0-alpha.2
impresscms	eq	1.4.0-rc
impresscms	eq	impresscms_1.3.3
impresscms	eq	1.3.11-rc2
impresscms	eq	1.3.10-beta
impresscms	eq	1.3.11-beta
impresscms	eq	1.3.8
impresscms	eq	1.3.11
impresscms	eq	1.3.9
impresscms	eq	1.3.9_rc