GHSA-xvgx-668j-f67p
Subrion CMS XSS
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | intelliants/subrion | <= 4.2.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the `v[language_switch]` parameter (within multipart/form-data), which is reflected back within a user's browser without proper output encoding.
References
External links from the advisory. They lead to third-party sites.