GHSA-W4PJ-7P68-3VGV Stored XSS in October

Impact A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. Patches Issue has been patched in Build 466 v1.0.466 & RainLab.Blog v1.4.1 by restricting the...

PT-2020-12540 · October +1 · October Cms +1

Name of the Vulnerable Software and Affected Versions: October CMS versions 1.0.319 through 1.0.465 RainLab.Blog plugin versions prior to 1.4.1 Description: A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other...