CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38146
https://notcve.org/view.php?id=CVE-2022-38146
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3). Silverstripe silverstripe/framework hasta 4.11 permite XSS (problema 2 de 3). • https://forum.silverstripe.org/c/releases https://www.silverstripe.org/blog/tag/release https://www.silverstripe.org/download/security-releases https://www.silverstripe.org/download/security-releases/CVE-2022-38146 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38148
https://notcve.org/view.php?id=CVE-2022-38148
Silverstripe silverstripe/framework through 4.11 allows SQL Injection. Silverstripe silverstripe/framework hasta 4.11 permite la inyección SQL. • https://forum.silverstripe.org/c/releases https://www.silverstripe.org/blog/tag/release https://www.silverstripe.org/download/security-releases https://www.silverstripe.org/download/security-releases/CVE-2022-38148 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-25238
https://notcve.org/view.php?id=CVE-2022-25238
Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code. Silverstripe silverstripe/framework versiones hasta 4.10.0, permite un ataque de tipo XSS, dentro de las etiquetas de script que pueden ser añadidas al contenido del sitio web por medio de XHR por un usuario autenticado del CMS si el módulo cwp-core no está instalado en el contig sanitise_server_side no está establecido a true en el código del proyecto • https://docs.silverstripe.org/en/4/changelogs/4.10.1 https://forum.silverstripe.org/c/releases https://www.silverstripe.org/blog/tag/release https://www.silverstripe.org/download/security-releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-19316
https://notcve.org/view.php?id=CVE-2020-19316
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. Una vulnerabilidad de inyección de comandos en el enlace de la función Filesystem.php en Laravel Framework versiones anteriores a 5.8.17 • http://www.netbytesec.com/advisories/OSCommandInjectionInLaravelFramework https://github.com/laravel/framework/commit/44c3feb604944599ad1c782a9942981c3991fa31 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2021-43808 – Blade `@parent` Exploitation Leading To Possible XSS in Laravel
https://notcve.org/view.php?id=CVE-2021-43808
Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. • https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b https://github.com/laravel/framework/pull/39906 https://github.com/laravel/framework/pull/39908 https://github.com/laravel/framework/pull/39909 https://github.com/laravel/framework/releases/tag/v6.20.42 https://github.com/laravel/framework/releases/tag/v7.30.6 https://github.com/laravel/framework/releases/tag/v8.75.0 https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-327: Use of a Broken or Risky Cryptographic Algorithm •