Cross-site Scripting (XSS)

concrete5 is vulnerable to cross-site scripting XSS attacks. The library is does not sanitize the getGroupBadgeDescription parameter in web/concrete/singlepages/members/profile.php, allowing a malicious user to inject and execute arbitrary web script...