Описание
Stored cross site scripting in RSS displayer
Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.
Пакеты
Наименование
concrete5/concrete5
composer
Затронутые версииВерсия исправления
< 9.1.0
9.1.0
Связанные уязвимости
CVSS3: 2
nvd
почти 3 года назад
Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.