GHSA-M3V5-GJJ9-RG24 Craft CMS vulnerable to HTML injection

Craft CMS through 4.4.9 is vulnerable to HTML Injection...

Craft CMS vulnerable to HTML injection

Craft CMS through 4.4.9 is vulnerable to HTML Injection...

CVE-2023-33495

Craft CMS through 4.4.9 is vulnerable to HTML Injection...

CVE-2023-33495

Craft CMS through 4.4.9 is vulnerable to HTML Injection...

Design/Logic Flaw

Craft CMS through 4.4.9 is vulnerable to HTML Injection...

CVE-2023-33495

Craft CMS through 4.4.9 is vulnerable to HTML Injection...

CVE-2023-33495

Craft CMS through 4.4.9 is vulnerable to HTML Injection...

CVE-2023-33495

CVE-2023-33495 affects Craft CMS up to version 4.4.9, where an HTML Injection vulnerability exists in the CMS (the exact root cause is described only as HTML Injection in the sources). Impact is described as enabling injection of HTML content, with a CVSS v3.1 base score of 6.1 (Medium). The avai...

PT-2023-24364 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: Craft CMS versions through 4.4.9 Description: The issue is related to HTML Injection. Recommendations: For versions through 4.4.9, update to a version later than 4.4.9 to resolve the issue...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic USA. A security vulnerability exists in Craft CMS 4.4.9 and earlier versions, which stems from vulnerability to HTML injection attacks...

CVE-2023-33495

Craft CMS through 4.4.9 is vulnerable to HTML Injection...

PT-2023-22567 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: CraftCMS version 3.7.59 Description: The issue concerns Server-Side Template Injection SSTI, where an authenticated attacker can inject Twig Template into the User Photo Location field in User Settings, potentially leading to Remote Code...

Remote Code Execution (RCE)

craftcms/cms is vulnerable to Remote Code Execution RCE. The vulnerability exists due to a lack of file extension validation in the resolveTemplate function when the name parameter is empty, which allows an admin authenticated attacker to upload and execute malicious code on the system...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

CVE-2023-33195

CVE-2023-33195 affects Craft CMS prior to 4.4.6, where a malformed RSS feed in the RSS widget could deliver a Cross‑Site Scripting (XSS) payload via the feed, enabling script execution. The issue is addressed by upgrading to Craft CMS 4.4.6 or later (patch referenced in the project release notes ...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from the US-based company Pixel & tonic. A security vulnerability exists in Craft CMS, which stems from an incorrectly formatted RSS feed that can deliver a payload with cross-site scripting...

CVE-2023-33196

Craft is a CMS for creating custom digital experiences. Cross site scripting XSS can be triggered by review volumes. This issue has been fixed in version 4.4.7...

CVE-2023-33194

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in...