GHSA-JM9M-RQR3-WFMH Kirby has insufficient permission checks in the language settings

TL;DR This vulnerability affects all Kirby sites with enabled languages option that might have potential attackers in the group of authenticated Panel users. If you have disabled the languages and/or api option and don't call any methods in your code that cause a write access to languages languag...

CVE-2023-38488: Improper Neutralization of Delimiters

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file e.g. via a...

Design/Logic Flaw

The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the shortcontent and fullcontent fields, leading to XSS attacks against admin panel users via posts/preview or posts/save...

CVE-2022-36433

The CVE-2022-36433 entry concerns Amasty Blog Pro for Magento 2 (version 2.10.3) where the blog-post creation functionality permits JavaScript injection in the short_content and full_content fields, enabling XSS against admin users via posts/preview or posts/save. Root cause is unfiltered content...

CVE-2022-36433

The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the shortcontent and fullcontent fields, leading to XSS attacks against admin panel users via posts/preview or posts/save...

Cross site scripting

The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response...

CVE-2021-41258: Improper Neutralization of Input During Web Page Generation

Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is then used in block snippets to convert the blocks to HTML for use in your templates. We recommend to escape HTML special characters to protect against...

PT-2021-23219

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 3.5.8 Description The issue concerns Kirby's blocks field, which stores structured data for each block, and this data is used in block snippets to convert blocks to HTML for use in templates. The default snippet for the...

CVE-2021-41252: Improper Neutralization of Input During Web Page Generation

Kirby is an open source file structured CMS Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other field types, it is not possible to escape HTML special characters against cross-site scripting XSS attacks, otherwise the formatting would be lost. If the user is...

PT-2021-23216

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 3.5.8 Description The issue concerns the writer field in Kirby, which stores formatted content as HTML code and does not escape HTML special characters against cross-site scripting XSS attacks. This allows malicious HTM...