Cross site scripting

A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions = 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively...

Craft CMS stored XSS in indexedVolumes

Summary XSS can be triggered via the Update Asset Index utility PoC 1. Access setting tab 2. Create new assets 3. In assets name inject payload: "alert26 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 7. Click Update asset indexes. XSS will be triggered Json response volumes...

GHSA-6QJX-787V-6PXR Craft CMS stored XSS in indexedVolumes

Summary XSS can be triggered via the Update Asset Index utility PoC 1. Access setting tab 2. Create new assets 3. In assets name inject payload: "alert26 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 7. Click Update asset indexes. XSS will be triggered Json response volumes...

Craft CMS stored XSS in review volume

Summary XSS can be triggered by review volumes PoC 1. Access setting tab 2. Create new assets 3. In assets name inject payload: "alert1337 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 6. Click Update asset indexes. 7. Wait to assets update success. 8. Progress complete. 9...

GHSA-CJMM-X9X9-M2W5 Craft CMS stored XSS in review volume

Summary XSS can be triggered by review volumes PoC 1. Access setting tab 2. Create new assets 3. In assets name inject payload: "alert1337 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 6. Click Update asset indexes. 7. Wait to assets update success. 8. Progress complete. 9...

GHSA-QPGM-GJGF-8C2X Craft CMS XSS in RSS widget feed

Summary A malformed RSS feed can deliver an XSS payload PoC Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss The XSS payload will be triggered by the title in tag Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f...

Craft CMS XSS in RSS widget feed

Summary A malformed RSS feed can deliver an XSS payload PoC Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss The XSS payload will be triggered by the title in tag Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic USA. A security vulnerability exists in Craft CMS. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...

Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic, Inc. A security vulnerability exists in Craft CMS, which stems from a cross-site scripting vulnerability that can be triggered by the Update Asset Index utility...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from the US-based Pixel & tonic, Inc. A security vulnerability exists in Pixel & tonic Craft CMS that stems from not filtering input and encoding output in Quick Post validation error messages, which would allow the delivery of loads with...

CVE-2023-2817

The CVE-2023-2817 issue is a post-authentication stored cross-site scripting vulnerability in Craft CMS versions up to 4.4.11. It allows HTML/script injection in field names, which triggers when those fields are added to a category or section and visited on Categories/Entries pages. Several conne...

Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic, Inc. A security vulnerability exists in Craft CMS, which stems from a cross-site scripting vulnerability that can be triggered by review volumes...

CVE-2023-2817

A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions = 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively...

PT-2023-24211 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft versions prior to 4.4.6 Description: The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. An older issue fixed the XSS in label HTML but did not address it when...

PT-2023-24213 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft versions prior to 4.4.7 Description: Cross-site scripting XSS can be triggered by review volumes. The issue is related to the index.php?p=admin/actions/asset-indexes/process-indexing-session function, where the skippedEntries and...

CVE-2023-2817

A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions = 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively...

PT-2023-21605 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: Craft CMS versions = 4.4.11 Description: A post-authentication stored cross-site scripting issue exists, allowing HTML, including script tags, to be injected into field names. This injection triggers when users visit the Categories or Entries...

PT-2023-24214 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft versions prior to 4.4.6 Description: Cross-site scripting XSS can be triggered via the Update Asset Index utility. This issue allows an attacker to inject malicious scripts, potentially leading to unauthorized access or data theft. The...

CVE-2023-2817

A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions = 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively...

PT-2023-24212 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft versions prior to 4.4.6 Description: A malformed RSS feed can deliver an XSS payload. The issue can be triggered by the title in the tag of an RSS feed. For example, creating an RSS widget and adding a malicious RSS feed can lead to the...