CVE-2025-66686

A stored Cross-Site Scripting XSS vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges can inject malicious JavaScript code into the “Help button url” setting within the admin panel. The injected payload is stored and executed when any...

CVE-2017-15948: Improper Neutralization of Input During Web Page Generation

Perch Content Management System 3.0.3 allows unrestricted file upload with resultant XSS via the Asset Title field in conjunction with the Select File field. This is exploitable with a Limited Admin account...

PT-2017-14305

Name of the Vulnerable Software and Affected Versions Perch Content Management System version 3.0.3 Description The issue allows for unrestricted file upload, which can lead to cross-site scripting XSS attacks. This can be exploited by using the Asset Title field in conjunction with the Select Fi...