~ / search / GHSA-44cg-qcpr-fwjh

GHSA-44cg-qcpr-fwjh

Cross site scripting in francoisjacquet/rosariosis

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-44565

Packages

EcosystemPackageAffectedFixed in
Packagist francoisjacquet/rosariosis < 7.6.1 7.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

A Cross Site Scripting (XSS) vulnerabilty exits in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JaveScript of HTML.An example of affected components are all Markdown input fields.

References

External links from the advisory. They lead to third-party sites.