PT-2012-1314

Name of the Vulnerable Software and Affected Versions SilverStripe versions 2.3.x through 2.3.9 SilverStripe versions 2.4.x through 2.4.3 Description A cross-site scripting XSS issue exists in the httpError method, allowing remote attackers to inject arbitrary web script or HTML via missing URL...

CVE-2010-4823: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the httpError method in sapphire/core/control/RequestHandler.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when custom error handling is not used, allows remote attackers to inject arbitrary web script or HTML via "missing URL actions."...