https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T14:54:44.305792+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-210567 EUVD-2026-210567 2026-10-08T14:54:44.352435+00:00 EUVD-2026-210567 https://cve.radiocsirt.org/vuln/fkie_cve-2024-53277 fkie_cve-2024-53277 2026-10-08T14:54:44.352477+00:00

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In some cases, form messages can contain HTML markup. This is an intentional feature, allowing links and other relevant HTML markup for the given message. Some form messages include content that the user can provide. There are scenarios in the CMS where that content doesn't get correctly sanitised prior to being included in the form message, resulting in an XSS vulnerability. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-ff6q-3c9c-6cf5 GHSA-ff6q-3c9c-6cf5 — Silverstripe Framework has a XSS in form messages 2026-10-08T14:54:44.352514+00:00

Affected: Packagist: silverstripe/framework

In some cases, form messages can contain HTML markup. This is an intentional feature, allowing links and other relevant HTML markup for the given message.

Some form messages include content that the user can provide. There are scenarios in the CMS where that content doesn't get correctly sanitised prior to being included in the form message, resulting in an XSS vulnerability.

### References

- https://www.silverstripe.org/download/security-releases/cve-2024-53277

## Reported by

Leo Diamat from [Bastion Security Group](http://www.bastionsecurity.co.nz/)