Silverstripe Framework has a XSS vulnerability in HTML editor

Impact A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch...

Cross-site Scripting (XSS)

Overview dnadesign/silverstripe-elemental is an Elemental pagetype and collection of Elements Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of user input in the Content blocks in use report. An attacker can execute arbitrary scripting co...

Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report

An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability is specific to that report and is a result of failure to cast input prior to including it in the grid field. References -...

CVE-2025-25197

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability i...

CVE-2025-25197 Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability i...

canoe-europe.org Cross Site Scripting vulnerability OBB-4043070

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

callonimac.it Cross Site Scripting vulnerability OBB-4043069

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bygptech.com Cross Site Scripting vulnerability OBB-4043067

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-30105

creationtimestamp| type| source ---|---|--- 2025-04-10 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-02 2025-05-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-02...

CVE-2025-31935

creationtimestamp| type| source ---|---|--- 2025-04-10 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-08 2025-04-11 15:50:55+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11447 2025-04-11 19:43:11+00:00| seen|...

CVE-2025-32119

creationtimestamp| type| source ---|---|--- 2025-04-10 09:49:03+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114313037970256953...

CVE-2024-13909

creationtimestamp| type| source ---|---|--- 2025-04-10 09:32:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmh73tucc42g...

CVE-2025-32228

creationtimestamp| type| source ---|---|--- 2025-04-10 08:48:56+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11209 2025-04-10 11:10:49+00:00| seen| https://t.me/cvedetector/22638 2025-04-10 11:32:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmhfslvgkg2i...

CVE-2025-32243

creationtimestamp| type| source ---|---|--- 2025-04-10 08:48:48+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11204 2025-04-10 11:10:35+00:00| seen| https://t.me/cvedetector/22628 2025-04-10 11:32:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmhfsnhsah2h...

vdw-sachsen.de Cross Site Scripting vulnerability OBB-4043054

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

floramedia.ch Cross Site Scripting vulnerability OBB-4043046

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

floraville-serviced-apartment.bangkokshotels.com Cross Site Scripting vulnerability OBB-4043041

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

fleischmagazin.de Cross Site Scripting vulnerability OBB-4043040

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

fix4dll.com Cross Site Scripting vulnerability OBB-4043031

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

fiskbokin.is Cross Site Scripting vulnerability OBB-4043027

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...