CVE-2019-20804

Gila CMS prior to 1.11.6 is affected by CVE-2019-20804. The flaw allows CSRF that results in Cross‑Site Scripting via the admin/themes URI, risking compromise of the admin account. Affected software: Gila CMS up to version 1.11.5 (1.11.6 fixes). Root cause: CSRF enabling XSS in the admin/themes p...