https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 14:22:45 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-210522 EUVD-2026-210522 https://cve.radiocsirt.org/vuln/euvd-2026-210522 https://cve.radiocsirt.org/vuln/fkie_cve-2023-33197 <p>Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.</p> <p>Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-33197 https://cve.radiocsirt.org/vuln/ghsa-6qjx-787v-6pxr <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>### Summary XSS can be triggered via the Update Asset Index utility</p> <p>### PoC 1. Access setting tab 2. Create new assets 3. In assets name inject payload: &#34;&lt;script&gt;alert(26)&lt;/script&gt; 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 7. Click Update asset indexes.</p> <p>XSS will be triggered</p> <p>Json response volumes name makes triggers the payload</p> <p>&#34;session&#34;:{&#34;id&#34;:1,&#34;indexedVolumes&#34;:{&#34;1&#34;:&#34;\&#34;&lt;script&gt;alert(26)&lt;/script&gt;&#34;},</p> <p>It’s run on every POST request in the utility.</p> <p>Resolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766</p> <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>### Summary XSS can be triggered via the Update Asset Index utility</p> <p>### PoC 1. Access setting tab 2. Create new assets 3. In assets name inject payload: &#34;&lt;script&gt;alert(26)&lt;/script&gt; 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 7. Click Update asset indexes.</p> <p>XSS will be triggered</p> <p>Json response volumes name makes triggers the payload</p> <p>&#34;session&#34;:{&#34;id&#34;:1,&#34;indexedVolumes&#34;:{&#34;1&#34;:&#34;\&#34;&lt;script&gt;alert(26)&lt;/script&gt;&#34;},</p> <p>It’s run on every POST request in the utility.</p> <p>Resolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766</p> https://cve.radiocsirt.org/vuln/ghsa-6qjx-787v-6pxr https://cve.radiocsirt.org/vuln/gsd-2023-33197 gsd-2023-33197 https://cve.radiocsirt.org/vuln/gsd-2023-33197