GitHub Advisoryadvisory · Packagist

GHSA-q9g7-pff4-548r Gleez Cms Cross-site Scripting in Profile Page

MEDIUM Published 2022-05-14 Modified 2024-04-25 Official page ↗
Aliases
CVE-2018-1999021
Ecosystem
Packagist
Packages
gleez/cms
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-25

Affected packages

• Packagist gleez/cms: <= 1.3.0 (no fix yet)

Description

Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in injection of arbitrary web script or HTML via the profile page editor. The victim must navigate to the attacker's profile page to exploit this vulnerability.

Related

Alias · CVE (1)

  • CVE-2018-1999021 Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in Inject arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References