Threats affecting pkg:github/fluentcms/FluentCMS

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authenticated administrator to upload crafted SVG files containing malicious JavaScript code. Once uploaded, the script executes in the browser of any user who accesses the direct URL of the image, including unauthenticated visitors.

FluentCMS version 1.2.3 contains a Cross Site Scripting (XSS) vulnerability in its TextHTML plugin. This vulnerability allows an attacker to execute malicious scripts in the context of a user's browser session. The vulnerability has a CVSS score of 6.1, indicating a medium severity level. There is no information about available patches or official remediation. No known exploits are reported in the wild at this time.

A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the <head> section, allowing remote attackers to inject arbitrary script tags.