CVE-2014-8577

Multiple cross-site scripting XSS vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 dataContacttitle parameter to admin/contacts/contacts/add page; 2 dataBlocktitle or 3 dataBlockalias parameter to admin/blocks/blocks/edit page; 4...

CVE-2014-8577

Multiple XSS vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary HTML/JavaScript via a range of POST parameters (e.g., data[Contact][title], data[Block][title/alias], data[Region][title], data[Menu][title/alias], data[Link][title]). Root cause: input is not properly ...