Threats tagged 'ghsa-84hf-8gh5-575j'

Kirby CMS versions 5.0.0 up to but not including 5.1.4 contain a cross-site scripting (XSS) vulnerability in the Panel's "Changes" dialog. This flaw allows authenticated Panel users or external visitors who can update page titles or usernames to inject malicious JavaScript code. The vulnerability requires user interaction by another authenticated Panel user and cannot be automated. It is patched in version 5.1.4.