~ / search / GHSA-q9g7-pff4-548r

GHSA-q9g7-pff4-548r

Gleez Cms Cross-site Scripting in Profile Page

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1999021

Packages

EcosystemPackageAffectedFixed in
Packagist gleez/cms <= 1.3.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in injection of arbitrary web script or HTML via the profile page editor. The victim must navigate to the attacker's profile page to exploit this vulnerability.

References

External links from the advisory. They lead to third-party sites.