1 matches found
GHSA-R9VP-FP72-XGF7 silverstripe/framework's `Member.Name` is not escaped
The core template framework/templates/Includes/GridFieldprint.ss uses "Printed by $Member.Name". If the currently logged in members first name or surname contain XSS, this prints the raw HTML out, because Member-getName just returns the raw FirstName + Surname as a string, which is injected...
5.4CVSS6.9AI score
SaveExploits0References7
20