https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 00:59:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267789 EUVD-2026-267789 https://cve.radiocsirt.org/vuln/euvd-2026-267789 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25491 <p>Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. This vulnerability is fixed in 5.8.22.</p> <p>Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. This vulnerability is fixed in 5.8.22.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25491 https://cve.radiocsirt.org/vuln/ghsa-7pr4-wx9w-mqwr <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>## Summary</p> <p>Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list.</p> <p>--- ## Proof of Concept</p> <p>### Required Permissions (Attacker)</p> <p>- Admin access (only admins have access to the settings page) - `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft).</p> <p>### Steps to Reproduce 1. Log in as an attacker. 2. Go to **Settings** -&gt; **Entry Types** (`/admin/settings/entry-types`). 3. Create a new Entry Type. 4. Set **Name** to: ```html &lt;img src=x onerror=&#34;alert(&#39;XSS-EntryTypes&#39;)&#34; hidden&gt; ``` 5. Save the Entry Type, and you’ll be redirected back to the entry types table automatically. 6. Notice the alert fires when the entry types table renders.</p> <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>## Summary</p> <p>Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list.</p> <p>--- ## Proof of Concept</p> <p>### Required Permissions (Attacker)</p> <p>- Admin access (only admins have access to the settings page) - `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft).</p> <p>### Steps to Reproduce 1. Log in as an attacker. 2. Go to **Settings** -&gt; **Entry Types** (`/admin/settings/entry-types`). 3. Create a new Entry Type. 4. Set **Name** to: ```html &lt;img src=x onerror=&#34;alert(&#39;XSS-EntryTypes&#39;)&#34; hidden&gt; ``` 5. Save the Entry Type, and you’ll be redirected back to the entry types table automatically. 6. Notice the alert fires when the entry types table renders.</p> https://cve.radiocsirt.org/vuln/ghsa-7pr4-wx9w-mqwr