Cross-Site Scripting (XSS)

craftcms/cms is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly sanitize user inputs before it output to the front end, allowing an attacker to inject and execute malicious javascript through the save function in QuickPostWidget.js...

Cross-Site Scripting (XSS)

craftcms/cms is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly sanitize user inputs before it output to the front end, allowing an attacker to inject and execute malicious javascript through the getIndexingSessionRowHtml function in AssetIndexer.ts via the Update...

Cross-site Scripting (XSS)

craftcms/cms is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the body.twig and links.twig due to the improper sanitization in the text attribute, which allows an attacker to inject and execute malicious javascript through the RSS feed...

CVE-2023-33194 CraftCMS stored XSS in Quick Post widget error message

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in...

CVE-2023-33194 CraftCMS stored XSS in Quick Post widget error message

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in...

CraftCMS stored XSS in Quick Post widget error message

Summary The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Details Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. PoC 1. Login at admin 2. Go to setting 3. Create a Section 4. On Entry page, cli...

GHSA-3WXG-W96J-8HQ9 CraftCMS stored XSS in Quick Post widget error message

Summary The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Details Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. PoC 1. Login at admin 2. Go to setting 3. Create a Section 4. On Entry page, cli...

CraftCMS Code Injection Vulnerability

CraftCMS is a CMS program. CraftCMS version v3.8.1 suffers from a code injection vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by Section parameters, which can be exploited by an attacker to execute arbitrary Web script or HTML by injecting a...

Cross-Site Scripting (XSS)

craftcms/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability exists in the RSS widget because of a malformed title which allows an attacker to inject and execute arbitrary JavaScript...

GHSA-FJX5-XM7Q-WHVJ CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter...

CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter...

CVE-2023-30130

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter...

Design/Logic Flaw

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter...

CVE-2023-30130

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter...

CraftCMS 代码注入漏洞

CraftCMS is a CMS program. CraftCMS version v3.8.1 suffers from a code injection vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by Section parameters, which can be exploited by an attacker to execute arbitrary Web script or HTML by injecting a...

CVE-2023-30130

Summary (CVE-2023-30130) CraftCMS v3.8.1 contains a code-injection vulnerability exploited by a crafted Script in the Section parameter. The issue arises from inadequate filtering/escaping of user-supplied data, enabling a remote attacker to execute arbitrary code. The CVSS 3.1 baseline indicates...

CVE-2023-30130

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter...

CVE-2023-30130

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter...

Cross-Site Scripting (XSS)

craftcms/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in Craft parameter of Asset.php which allows an attacker to inject and execute arbitrary JavaScript into the browser...

craftcms/cms vulnerable to cross site scripting in RSS feed widget

A malformed title in the feed widget of craftcms/cms can deliver an XSS payload. This has been resolved in this commit...