Cross-site Scripting (XSS)

2023-05-3004:06:14

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

craftcms

xss

vulnerability

improper sanitization

rss feed

javascript

EPSS

0.001

Percentile

32.9%

JSON

craftcms/cms is vulnerable to Cross-site Scripting (XSS). The vulnerability exists in the body.twig and links.twig due to the improper sanitization in the text attribute, which allows an attacker to inject and execute malicious javascript through the RSS feed.