Cross-site Scripting (XSS)

symphonycms/symphony-2 is vulnerable to cross-site scripting XSS attacks. Attackers are able to inject web script through the following parameters in content/content.systempreferences.php: emailsendmailfromname, emailsendmailfromaddress, emailsmtpfromname, emailsmtpfromaddress, emailsmtphost,...

Remote Code Execution (RCE)

symphonycms/symphony-2 is vulnerable to remote code execution RCE. This is due to a lack of sanitization on user input strings, allowing a malicious user to inject and execute arbitrary script through symphony/content/content.blueprintsdatasources.php...