GHSA-v2f3-f8x4-m3w8
Cross Site Scripting in LavaLite CMS
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | lavalite/cms | <= 5.8.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".
References
External links from the advisory. They lead to third-party sites.