GHSA-xhc3-5pgf-p576

subrion CMS Cross Site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-23761

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	intelliants/subrion	<= 4.2.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-23761 advisory
https://github.com/intelliants/subrion package
https://subrion.org web
http://hidden-one.co.in/2021/04/09/cve-2020-23761-stored-xss-vulnerability-in-subrion-cms-version web