Cross-Site Scripting (XSS)

concrete5 is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in ExternalFileEntry.php, which allows an attacker to inject and execute arbitrary JavaScript into the browser...