PT-2019-9282

Name of the Vulnerable Software and Affected Versions Symphony versions prior to 3.3.0 Description The issue allows for remote attacks via XSS in the Title under Post. The articleTitle ID is stored in the articleTitle JSON field. When accessing the "/member/test/points" URI, it executes a payload...

CVE-2018-16249: Improper Neutralization of Input During Web Page Generation

In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated us...