Most recent entries from all

EUVD-2026-270466

fkie_cve-2026-27196

Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.

GHSA-8r7r-f4gm-wcpq — Statamic affected by privilege escalation via stored cross-site scripting

Affected: Packagist: statamic/cms

## Impact

Stored XSS vulnerability in `html` fieldtypes allow authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.

## Patches

This has been fixed in 6.3.2 and 5.73.9.