Formwork Cross-site Scripting (XSS) from Page title field

Description A stored cross-site scripting XSS vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field. Only users with access to Administration Panel with page editing permission can inject raw HTML in th...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter...

CVE-2023-24230

Formwork v1.12.1 contains a stored XSS in the /formwork/panel/dashboard component, exploitable via the Page title field. Root cause is unsanitized input leading to script/HTML execution. CVSS 3.1 base score 4.8 (Medium) with PR:H, UI:R, scope Changed; impact on confidentiality/integrity is Low. A...