Cross Site Scripting

concrete5/concrete5 is vulnerable to Cross Site Scripting. The vulnerability is due to insufficient validation of administrator-provided data in the Name field of a Group type, allowing a rogue administrator to inject malicious code. This code may execute when users visit the affected page...