SUSE-SU-2025:20184-1 Security update for elemental-operator

This update for elemental-operator fixes the following issues: - Updated to version 1.6.8: Deactivated e2e workflow Updated header year CVE-2025-22870: golang.org/x/net/proxy: Fixed proxy bypass using IPv6 zone IDs bsc1238700 CVE-2025-22869: golang.org/x/crypto/ssh: Fixed Denial of Service in the...

Security update for elemental-operator

This update for elemental-operator fixes the following issues: Updated to version 1.6.8: Deactivated e2e workflow Updated header year CVE-2025-22870: golang.org/x/net/proxy: Fixed proxy bypass using IPv6 zone IDs bsc1238700 CVE-2025-22869: golang.org/x/crypto/ssh: Fixed Denial of Service in the K...

Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report

An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability is specific to that report and is a result of failure to cast input prior to including it in the grid field. References -...

GHSA-X8XM-C7P8-2PJ2 Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report

An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability is specific to that report and is a result of failure to cast input prior to including it in the grid field. References -...

Cross-site Scripting (XSS)

Overview dnadesign/silverstripe-elemental is an Elemental pagetype and collection of Elements Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of user input in the Content blocks in use report. An attacker can execute arbitrary scripting co...

CVE-2025-25197

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability i...

CVE-2025-25197 Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability i...

CVE-2025-25197

SilverStripe Elemental vulnerability CVE-2025-25197 affects the Elemental module's handling of content blocks in the "Content blocks in use" report. Affected component: elemental grid field rendering; root cause is failure to cast input before including it in the grid field, which allows an XSS p...

CVE-2025-25197 Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability i...

CVE-2025-25197 Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability i...

CVE-2025-25197

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability i...

CVE-2025-25197 - XSS attack in elemental "Content blocks in use" report

More info at https://www.silverstripe.org/download/security-releases/cve-2025-25197...

CVE-2025-25197: Improper Neutralization of Input During Web Page Generation

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability i...

PT-2025-15980 · Silverstripe · Silverstripe Elemental

Name of the Vulnerable Software and Affected Versions: Silverstripe Elemental versions prior to 5.3.12 Description: The issue arises from the failure to cast input prior to including it in the grid field, allowing an elemental block to include an XSS payload. This payload can be executed when...

elemental-net.ca Cross Site Scripting vulnerability OBB-3695580

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malware in born-of-water-elemental-origins-1-by-al-knorr-online-full-volumes-

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in born-of-water-elemental-origins-1-by-al-knorr-online-full-volumes- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13ed688a98ceec7189e73832c965d435ff1c7495d8acb4df863273d491b6a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2693 Malicious code in elemental-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1a68aeaefed156f19d6f0c11e548a2123da4888d3617370086ca94f111d62fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in elemental-layout

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in elemental-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1a68aeaefed156f19d6f0c11e548a2123da4888d3617370086ca94f111d62fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...