https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T16:43:23.850881+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-228210 EUVD-2026-228210 2026-10-08T16:43:23.904544+00:00 EUVD-2026-228210 https://cve.radiocsirt.org/vuln/fkie_cve-2025-30148 fkie_cve-2025-30148 2026-10-08T16:43:23.904594+00:00

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitized on the client-side, but server-side sanitization doesn't catch it. The server-side sanitization logic has been updated to sanitize against this attack. This vulnerability is fixed in 5.3.23.

 https://cve.radiocsirt.org/vuln/ghsa-rhx4-hvx9-j387 GHSA-rhx4-hvx9-j387 — Silverstripe Framework has a XSS vulnerability in HTML editor 2026-10-08T16:43:23.904676+00:00

Affected: Packagist: silverstripe/framework

### Impact

A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it.

The server-side sanitisation logic has been updated to sanitise against this attack.

### Reported by

James Nicoll from Fujitsu Cyber

### References

- https://www.silverstripe.org/download/security-releases/cve-2025-30148