CVE-2021-38709

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staffmessaging messaging system for XSS...

CVE-2021-38709

The CVE concerns ocProducts Composr CMS prior to 10.0.38, where the staff_messaging system allows JavaScript injection, enabling XSS. Root cause: inadequate input handling in the staff_messaging pathway leading to script injection. Impact (per sources): attacker-supplied script execution in the c...