Multiple cross-site scripting (XSS) vulnerabilities in…
Priority LOW 31CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) email_sendmail[from_name], (2) email_sendmail[from_address], (3) email_smtp[from_name], (4) email_smtp[from_address], (5) email_smtp[host], (6) email_smtp[port], (7) jit_image_manipulation[trusted_external_sites], or (8) maintenance_mode[ip_whitelist] parameters to system/preferences.
Why it matters now
EPSS 0.01767 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed symphonycms/symphony-2 (Packagist): 2.6.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | symphonycms/symphony-2 (Packagist) | before 2.6.4 | 2.6.4 | Patch available | GHSA-4c5w-qqfg-grf3 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- symphonycms/symphony-2 (Packagist) Vendor— Affected before 2.6.4 Fixed in 2.6.4 Patch available GHSA-4c5w-qqfg-grf3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:getsymphony:symphony:*:*:*:*:*:*:*:* | up to 2.6.3 | Vulnerable | Getsymphony |
- cpe:2.3:a:getsymphony:symphony:*:*:*:*:*:*:*:* Versions up to 2.6.3 Vulnerable ·Getsymphony
Remediation
- Fix · GHSA-4c5w-qqfg-grf3 symphonycms/symphony-2 (Packagist) Fixed in 2.6.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2015-8766
- 2026-10-03 Alias added: GHSA-4c5w-qqfg-grf3
References
Other 5
- https://github.com/symphonycms/symphony-2/commit/651e150091c61fb60ad1dff2bc2166185a83d9d6
- https://cybersecurityworks.com/zerodays/cve-2015-8766-getsymphoney.html
- https://github.com/symphonycms/symphony-2
- https://web.archive.org/web/20210321090853/https://cybersecurityworks.com/zerodays/cve-2015-8766-getsymphoney.html
- http://www.getsymphony.com/download/releases/version/2.6.4
More Getsymphony Symphony vulnerabilities
- TI-2017-05330 Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php… CVSS 3.0HIGH 8.8
- TI-2016-03695 Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is… CVSS 3.1HIGH 7.5
- TI-2010-02055 Directory traversal vulnerability in index.php in Symphony CMS 2.0.7 allows remote… CVSS 2.0HIGH 7.5
- TI-2020-15873 A XML External Entity (XXE) vulnerability was discovered in… CVSS 3.1CRITICAL 9.1
- TI-2010-03290 SQL injection vulnerability in lib/toolkit/events/event.section.php in Symphony CMS 2.0.7… CVSS 2.0HIGH 7.5
- TI-2013-02264 SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated… CVSS 2.0MEDIUM 6.5
Sources
- CVE-2015-8766 · CVE Program
- CVE-2015-8766 · NVD
- FIRST EPSS
- GHSA-4c5w-qqfg-grf3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences