~ / search / GHSA-q5fg-v5p7-r424

GHSA-q5fg-v5p7-r424

Croogo vulnerable to Cross-site Scripting in title field

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-7173

Packages

EcosystemPackageAffectedFixed in
Packagist croogo/croogo < 3.0.7 3.0.7

Details

As written in the advisory (Markdown source, shown as plain text).

A stored self-XSS exists in Croogo before v3.0.7, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4.

References

External links from the advisory. They lead to third-party sites.