Information Disclosure

craftcms/cms is vulnerable to information disclosure. A malicious user can use the redirect URL parameter in src/controllers/BaseController.php to display arbitrary sensitive information...

Cross-Site Scripting (XSS)

craftcms/cms is vulnerable to cross-site scripting XSS attacks. The library does not properly handle strings in the control panel, allowing a malicious user to inject and execute arbitrary web script...

Cross-Site Scripting (XSS)

craftcms/cms is vulnerable to cross-site scripting XSS attacks. The attacks are possible because it does not escape the log output from src/templates/utils/logs.html in log viewer tool...