GitHub Advisoryadvisory · Packagist

GHSA-79hv-pfx6-hhpj Cross-site scripting (XSS)

MEDIUM Published 2021-03-12 Modified 2021-03-12 Official page ↗
Aliases
CVE-2021-28088
Ecosystem
Packagist
Packages
impresscms/impresscms
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2021-03-12

Affected packages

• Packagist impresscms/impresscms: <= 1.4.2 (no fix yet)

Description

Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML parameters through the "Display Name" field.

Related

Alias · CVE (1)

  • CVE-2021-28088 Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References