https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:43:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-162205 EUVD-2026-162205 https://cve.radiocsirt.org/vuln/euvd-2026-162205 https://cve.radiocsirt.org/vuln/fkie_cve-2024-45406 <p>Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.</p> <p>Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-45406 https://cve.radiocsirt.org/vuln/ghsa-28h4-788g-rh42 <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>### Summary Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input.</p> <p>### Details 1. In the **/admin/categories** page, category title isn&#39;t sanitized and triggered xss. 2. In the category edit page under the **/admin/categories/**, category title in breadcrumb list isn&#39;t sanitized and triggered xss. 3. In the **/admin/entries** page, entry title isn&#39;t sanitized and triggered xss. 4. In the entry edit page under the **/admin/entries/**, entry title in breadcrumb list isn&#39;t sanitized and triggered xss. 5. In the **/admin/myaccount** and pages under it, username or full name in breadcrumb list isn&#39;t sanitized and triggered xss.</p> <p>### Impact Malicious users can tamper with the control panel.</p> <p>### PoC #### 1. In the **/admin/categories** page, category title isn&#39;t sanitized and triggered xss. ``` 1. Access to the Settings -&gt; Categories ( /admin/settings/categories ) 2. Create new category group 3. Access to the Categories page ( /admin/categories/ ) 4. Push the New category button 5. Input the Title column : xss&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt; 6. Push the Create Category or Save button 7. Access to the Categories page again and it triggers xss ```   </p> <p>#### 2. In the ca…</p> <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>### Summary Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input.</p> <p>### Details 1. In the **/admin/categories** page, category title isn&#39;t sanitized and triggered xss. 2. In the category edit page under the **/admin/categories/**, category title in breadcrumb list isn&#39;t sanitized and triggered xss. 3. In the **/admin/entries** page, entry title isn&#39;t sanitized and triggered xss. 4. In the entry edit page under the **/admin/entries/**, entry title in breadcrumb list isn&#39;t sanitized and triggered xss. 5. In the **/admin/myaccount** and pages under it, username or full name in breadcrumb list isn&#39;t sanitized and triggered xss.</p> <p>### Impact Malicious users can tamper with the control panel.</p> <p>### PoC #### 1. In the **/admin/categories** page, category title isn&#39;t sanitized and triggered xss. ``` 1. Access to the Settings -&gt; Categories ( /admin/settings/categories ) 2. Create new category group 3. Access to the Categories page ( /admin/categories/ ) 4. Push the New category button 5. Input the Title column : xss&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt; 6. Push the Create Category or Save button 7. Access to the Categories page again and it triggers xss ```   </p> <p>#### 2. In the ca…</p> https://cve.radiocsirt.org/vuln/ghsa-28h4-788g-rh42