213 matches found
CVE-2022-38147
Silverstripe silverstripe/framework through 4.11 allows XSS issue 3 of 3...
CVE-2022-37430
Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link issue 2 of 2...
CVE-2022-37429
Silverstripe silverstripe/framework through 4.11 allows XSS issue 1 of 2 via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters...
silverstripe framework 跨站脚本漏洞
silverstripe framework is a CMS web framework. A cross-site scripting vulnerability exists in silverstripe framework versions 3.0.0 and later and 4.11.1 and earlier, which stems from a lack of effective filtering and escaping of user-supplied data and can be exploited by an attacker to execute...
Design/Logic Flaw
Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request...
SQL Injection
silverstripe/framework is vulnerable to SQL Injection. The vulnerability exists in the getManipulatedData function in GridFieldSortableHeader.php where an attacker with cms access could execute an arbitrary sql statements...
silverstripe framework 跨站脚本漏洞
silverstripe framework is a set of CMS website framework. A security vulnerability exists in silverstripe framework version 4.11.0 and earlier, silverstripe/assets version 1.11.0 and earlier, and silverstripe/asset-admin version 1.11.0 and earlier. An attacker could exploit this vulnerability to...
CVE-2022-38462
Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request...
URL XSS vulnerability due to outdated jquery in CMS
Silverstripe silverstripe/framework through 4.11 allows XSS issue 2 of 3...
CVE-2022-38148
Silverstripe silverstripe/framework through 4.11 allows SQL Injection...
PT-2022-24240 · Silverstripe · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions through 4.11 Description: The issue allows SQL Injection, which can be exploited by an attacker with CMS access to execute arbitrary SQL statements. This is achieved by adding an SQL payload in...
CVE-2022-38146
Silverstripe silverstripe/framework through 4.11 allows XSS issue 2 of 3...
PT-2022-24239 · Silverstripe · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.11 and earlier Description: The issue allows for XSS attacks. A malicious content author could upload a GPX file with a Javascript payload. The payload could then be executed by luring a legitima...
PT-2022-23994 · Silverstripe · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions through 4.11 Description: The issue allows for an XSS vulnerability via the href attribute of a link. A malicious content author could add a JavaScript payload to the href attribute. This is simila...
Cross-site Scripting (XSS)
silverstripe/framework is vulnerable to cross-site scripting. The vulnerability exists because the $sanitiseserverside attribute in HTMLEditorField.php is false by default, allowing an attacker to inject and execute malicious javascript...
Stored Cross-Site Scripting (XSS)
silverstripe/framework is vulnerable to cross-site scriptingXSS attacks. The library does not properly sanitize user inputs through links and iframes, allowing a remote authenticated attacker to inject and execute malicious javascript via XMLHttpRequest XHR...
GHSA-JX34-GQQQ-R6GM Stored XSS via HTML fields in SilverStripe Framework
SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...
Stored XSS in link tags added via XHR in SilverStripe Framework
SilverStripe Framework 4.x prior to 4.10.9 is vulnerable to cross-site scripting inside the href attribute of an HTML hyperlink, which can be added to website content via XMLHttpRequest XHR by an authenticated CMS user...
