Croogo vulnerable to XSS in Blog field

2022-05-1401:38:19

Google

osv.dev

0.001 Low

EPSS

Percentile

25.0%

JSON

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog.

CPENameOperatorVersion
croogo/croogoeq3.0.4
croogo/croogoeq3.0.0-alpha.1
croogo/croogoeq2.0.0
croogo/croogoeq2.3.3
croogo/croogoeq3.0.0-alpha.2
croogo/croogoeq3.0.6
croogo/croogoeq2.3.2
croogo/croogoeq2.2.4
croogo/croogoeq2.2.0
croogo/croogoeq2.2.2

Name	Operator	Version
croogo/croogo	eq	3.0.4
croogo/croogo	eq	3.0.0-alpha.1
croogo/croogo	eq	2.0.0
croogo/croogo	eq	2.3.3
croogo/croogo	eq	3.0.0-alpha.2
croogo/croogo	eq	3.0.6
croogo/croogo	eq	2.3.2
croogo/croogo	eq	2.2.4
croogo/croogo	eq	2.2.0
croogo/croogo	eq	2.2.2