CVE-2022-40849

ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting XSS. An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's...

CVE-2022-40849

ThinkCMF 6.0.7 is affected by a Stored XSS vulnerability in the Slideshow Management section. The flaw allows an attacker to inject a persistent XSS payload that executes arbitrary JavaScript on the client, potentially enabling theft of the administrator’s PHPSESSID. The available documents do no...