Lucene search
+L

1 matches found

OSV
OSV
added 2024/05/27 6:58 p.m.7 views

GHSA-R9VP-FP72-XGF7 silverstripe/framework's `Member.Name` is not escaped

The core template framework/templates/Includes/GridFieldprint.ss uses "Printed by $Member.Name". If the currently logged in members first name or surname contain XSS, this prints the raw HTML out, because Member-getName just returns the raw FirstName + Surname as a string, which is injected...

5.4CVSS6.9AI score
SaveExploits0References7
Rows per page
Query Builder