CVE-2018-16249

In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated us...

CVE-2018-16249

Symphony (before 3.3.0) is affected by a stored XSS in the articleTitle field of the Title under Post. An admin-authenticated user can insert arbitrary HTML/JS via a crafted site name, triggering payload execution when accessing /member/test/points. The vulnerability stems from how the articleTit...