CVE-2015-3989

EPSS 0.26%

concrete5 vulnerable to Cross-site Scripting

Published: 5/17/2022Modified: 4/14/2025
Also known as:GHSA-jxhp-rwqv-9fjj

Description

Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 4.0—CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U

References (4)