CVEvulnerability

CVE-2024-26482

7.1 HIGH Published 2024-02-22 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-02-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-80

Description

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur.

Affected configurations

• getkirby kirby 4.1.0

Related

Weakness · CWE (1)

  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References