GHSA-X5M4-G2CQ-52PQ Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

Summary There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and write...

CVE-2019-12313: Improper Neutralization of Input During Web Page Generation

XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element...